CVE-2026-64387

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the client attempts to free the same memory buffer twice during a directory query operation. An attacker could potentially exploit this flaw to cause memory corruption,...

SUSE CVE-2026-64383

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifssendrecv stores a replacement...

SUSE CVE-2026-64384

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2notifyinit fails before the next send, cleanup retains the previous buffer type and...

SUSE CVE-2026-64401

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

CVE-2026-64401

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

CVE-2026-64388

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

CVE-2026-64385

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...

CVE-2026-64380

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64386

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64257

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

UBUNTU-CVE-2026-64386

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

UBUNTU-CVE-2026-64382

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

UBUNTU-CVE-2026-64257

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

UBUNTU-CVE-2026-64387

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

UBUNTU-CVE-2026-64380

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

EUVD-2026-48792

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

CVE-2026-64448

Summary (CVE-2026-64448): The Linux kernel fix addresses a SMB2 negotiation bug in CIFS/NTLM handling. A long-standing quirk in smb2_check_message() unconditionally granted a +1 length exemption for responses, even when a data area was present. This could cause the decoder to read past the receiv...

CVE-2026-64401 smb: client: resolve SWN tcon from live registrations

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

CVE-2026-64387 smb: client: fix query directory replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...