CVE-2026-99275

A flaw was found in the Linux kernel's SMB Server Message Block client. A malicious SMB server can exploit this vulnerability to trigger an out-of-bounds memory read, leading to sensitive information disclosure. Due to missing packet length checks on truncated session setup responses, the client...

CVE-2026-99272

A flaw was found in the Linux kernel's Server Message Block SMB client. The SMB2 read handler does not properly validate whether the data range specified by the server fits within the boundaries of the received packet. A malicious SMB server could exploit this vulnerability by sending a crafted...

CVE-2026-99274

A flaw was found in the Linux kernel's SMB client. When handling file extent mapping fiemap requests, the client improperly validates empty truncated responses from the server. A malicious SMB server can exploit this vulnerability by returning a specially crafted response, triggering an...

CVE-2026-99272 smb: client: validate the data area in SMB2_read()

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2read SMB2read copies le32tocpursp-DataLength bytes from char rsp + rsp-DataOffset without checking that the range lies within the response actually received. A READ response with...

CVE-2026-98171

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious or compromised remote server can exploit this flaw by sending specially crafted compound encrypted network responses. Due to improper bounds validation and pointer lifecycle management, the client can encounter a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce-tgthint in freetgts When freetgts frees all structures in ce-tlist, ce-tgthint is left pointing to one of the freed cachedfstgt structures. If ce-tgthint is not reset before it is used later, it results in a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd “smb/client: fix possible infinite loop and out-of-bounds read in symlinkdata” compares the post-ALIGN length with the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel fails, it drops that reference and then increments...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parsedfsreferrals validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...

Blackash-CVE-2025-33073

✨ CVE-2025-33073: Windows SMB RCE Vulnerability 🚨 🔥 High-Severity Authenticated Remote Code Execution 🔥 Improper Access Control in Windows SMB Client CWE-284 🛡️ Key Details at a Glance Aspect| Details ---|--- CVSS v3.1 Score| 8.8 High 🔥 Affected Systems| Windows 10, 11, Server 2012–2025 all...

windows-smb-vulnerability-framework-cve-2025-33073

Windows SMB Client Vulnerability Research Framework Author: cyberseallll Created: 2025 Overview I developed this research framework to analyze and understand CVE-2025-33073, a critical Windows SMB Client Elevation of Privilege vulnerability. This implementation provides comprehensive tools for...

cifswitch-check

cifswitch-check A shell script to check whether a Linux system is exposed to CIFSwitch CVE-2026-46243 — a local privilege escalation vulnerability in the Linux kernel's CIFS/SMB client that has been present since 2007. Runs on bare-metal hosts, VMs, and inside containers. Designed to drop straigh...

CVE-2025-33073

CVE-2025-33073 — Windows SMB Client NTLM Reflection EoP Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. An improper access control flaw in the Windows SMB Client that revives NTLM reflection techniques thought to be mitigated — letti...

CVE-2026-46243

🚨 CVE-2026-46243 - CIFSwitch Linux Kernel Local Privilege Escalation LPE Local Privilege Escalation vulnerability affecting the Linux Kernel CIFS/SMB client. 📖 Overview CVE-2026-46243 is a Local Privilege Escalation LPE vulnerability within the Linux Kernel's CIFS/SMB client. Improper validation ...

Exploit for CVE-2026-97555

CVE-2026-97555 — cifs DACL owner/group heap overflow English...

CVE-2026-99111

A flaw was found in the Linux kernel's Server Message Block SMB client. Inadequate locking during file truncation allows a local user to perform concurrent write operations while a file is being truncated. This race condition causes newly written data to be discarded silently, resulting in data...