CVE-2026-98683

A flaw was found in the Linux kernel's SMB client. When zeroing a range within a file that does not reach the end of the file, dirty cached data is not flushed before the client requests the server to zero the region. A local user performing a zero-range operation could cause dirty cached pages t...

CVE-2026-98682

A flaw was found in the Linux kernel's Server Message Block SMB client subsystem. Due to improper synchronization during server-side file copy and clone operations, pending write operations are not drained before copying begins. A local user could exploit this timing issue during copy operations ...

CVE-2026-98681

A flaw was found in the Linux kernel's SMB Server Message Block client. Multiple internal file status flags shared the same memory byte without unified locking, creating a race condition during concurrent file operations. A local user performing simultaneous file operations could cause updates to...

pentestly

Pentestly Pentestly is a combination of expanding Python tools for use in penetration tests. The goal is to utilize a familiar user interface while making contributions to the framework easy with the power of Python. Blog post: Pentestly Framework: When Pentesting Meets Python and Powershell...

RLSA-2026:85321 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: sctp: diag: reject stale...

kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

CVE-2026-93210

A flaw was found in the Linux kernel's Server Message Block SMB client Distributed File System DFS cache. This vulnerability occurs due to improper handling of invalid target hints, specifically when a null pointer is dereferenced within the dfscachenorequpdatetgthint function. An attacker could...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-21725)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to unset link speed It isn't guaranteed that NETWORKINTERFACEINFO::LinkSpeed will always be set by the server, so the client must handle any values and then prevent oopses like below from happening: Oops...

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: USB: serial: ioti: fix heap overflow in getmanufin...

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791949745)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791949745 advisory. - In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buff...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: USB: serial: mxuport: fix memory...

Siemens SIMATIC S7-1500 TM MFP Improper Validation of Consistency within Input (CVE-2026-31709)

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl buildsecdesc and idmodetocifsacl derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31613)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUSSTOPPEDONSYMLINK, smb2checkmessage returns success without any length validation, leaving the symlink parsers as the only defense against an...

Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Read (CVE-2026-43112)

In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath When cifssanitizeprepath is called with an empty string or a string containing only delimiters e.g., '/', the current logic attempts to check cursor2 - 1 before cursor2...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46185)

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlinkdata Since smb2checkmessage returns success without length validation for the symlink error response, in symlinkdata it is possible for iov-iovlen to be smaller than sizeofstruct...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43350)

In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parsedacl treats an ACE SID matching sidunixNFSmode as an NFS mode SID and reads sid.subauth2 to recover the mode bits. That assumes the ACE carries three...

Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Write (CVE-2026-46195)

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parsesecdesc, buildsecdesc, and the chown path in idmodetocifsacl all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returne...

MiracleLinux 9 : kernel-5.14.0-687.45.1.el9_8 (AXSA:2026-2001:95)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2001:95 advisory. kernel: can: bcm: add locking for bcmop runtime updates CVE-2025-38004 kernel: iouring/poll: fix signed comparison in iopollgetownership...