CVE-2026-98183 wifi: mac80211: avoid out-of-bounds read for empty PREQ elements

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...

CVE-2026-98183

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...

CVE-2026-98180

The Linux kernel contains a vulnerability in the drm/msm driver where msm_ringbuffer_destroy() and msm_gem_vm_free() use kfree() instead of kfree_rcu() to release objects containing a drm_gpu_scheduler . Because the scheduler fence maintains a .release callback, it is not ops-detached upon signal...

CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

EUVD-2026-93098

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

CVE-2026-98170

The Linux kernel contains an out-of-bounds read vulnerability in the smb: client component within the move_smb2_ea_to_cifs() function. The root cause is an insufficient loop condition (while (src_size > 0)) that allows iteration to continue even when the remaining src_size is too small to hold...

CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98169

A vulnerability exists in the Linux kernel 's SMB client where the smb3_enum_snapshots() function fails to verify the actual length of a server's reply. Specifically, if snapshot_array_size is smaller than GMT_TOKEN_SIZE, the function sets ret_data_len to the size of struct smb_snapshot_array. Si...

EUVD-2026-93097

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98169

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98168

The Linux kernel contains a vulnerability in the SMB client component within the cifs_query_reparse_point() function. The root cause is an insufficient bounds check where the code verifies that the start pointer is within the response but fails to ensure at least 8 bytes remain for the reparse_da...

CVE-2026-98168 smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2026-98168 smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

EUVD-2026-93096

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

EUVD-2026-93095

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...

CVE-2026-98167 smb: client: fix server->total_read for compound encrypted PDUs

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...

CVE-2026-98167

The Linux kernel SMB client contains a vulnerability in receive_encrypted_standard() where server->total_read incorrectly maintains the full decrypted frame size while processing sub-PDUs of a compound encrypted frame . This oversight causes cifs_handle_standard() to pass an incorrect size to ...

CVE-2026-98167 smb: client: fix server->total_read for compound encrypted PDUs

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...