CVE-2026-97560

The Linux kernel contains a one-byte out-of-bounds (OOB) read vulnerability within the smb2_parse_native_symlink() function of the SMB client. The flaw occurs when parsing a share-root relative native symlink, where memcpy copies smb_target+1 (skipping the leading separator) but incorrectly uses ...

CVE-2026-97560 smb: client: fix one-byte OOB read in smb2_parse_native_symlink()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

CVE-2026-97559

The Linux kernel contains a vulnerability in the SMB client where the functions replace_sids_and_copy_aces() and set_chmod_dacl() incorrectly use a u16 accumulator to track DACL size. This causes an integer wraparound when the rewritten DACL exceeds 64K (specifically reaching a wraparound with 86...

CVE-2026-97558

The Linux kernel contains a vulnerability in the SMB client where a cifsFileInfo reference leak occurs during a deferred close operation. The issue stems from a race condition in cifs_close(): if deferred_close_scheduled becomes false while work is pending, subsequent cifs_open() calls may reuse ...

CVE-2026-97558 smb: client: fix cifsFileInfo reference leak in deferred close

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

EUVD-2026-86865

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97556

The Linux kernel contains a vulnerability in the SMB client where a reference count leak occurs when cifs_sb_tlink() fails, specifically in setups using the "-o multiuser" option. The cifs_oplock_break() function fails to release the file reference in this specific failure path, which can lead to...

CVE-2026-97556 smb: client: avoid leaking refcount when cifs_sb_tlink() fails

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

CVE-2026-97557

The Linux kernel contains a vulnerability in the CIFS (SMB) client where cifs_queue_oplock_break() unconditionally increments a file reference count before attempting to queue cifs_oplock_break(). If the work item is already queued, queue_work() returns false, causing the reference count to leak....

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555

A heap overflow vulnerability exists in the Linux kernel 's SMB client within the DACL owner/group rewrite process. When id_mode_to_cifs_acl rewrites an existing DACL, it incorrectly allocates a buffer based on the on-disk length. If the replacement SIDs obtained from the cifs.idmap upcall are lo...

CVE-2026-97554 smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

CVE-2026-97554

A vulnerability exists in the Linux kernel SMB client within the cifs_posix_to_fattr() function. The issue stems from the function ignoring the return value of posix_info_parse() . When processing a malformed POSIX directory entry from an untrusted server (such as one with invalid SID lengths), t...

CVE-2026-98125

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

CVE-2026-97557

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

Linux Distros Unpatched Vulnerability : CVE-2026-98126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE,...

UBUNTU-CVE-2026-97561

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

UBUNTU-CVE-2026-97558

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

Linux Distros Unpatched Vulnerability : CVE-2026-98127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: validate new EOF for insert range smb3insertrange does not check if the new file size isize + len is valid. This allows FALLOCFLINSERTRANGE to bypas...