UBUNTU-CVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

UBUNTU-CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

UBUNTU-CVE-2026-64396

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...

CVE-2026-64395 ksmbd: require source read access for duplicate extents

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

CVE-2026-64387

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

CVE-2026-64381

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs already reached MAXCOMPOUND. If the limit check fails, the function...

CVE-2026-64257 smb: client: reject overlapping data areas in SMB2 responses

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

PT-2026-64607

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt can return a replayable error and free its response buffer. If the SMB2 query info init function fails before the...

PT-2026-64612

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where Alternate Data Streams ADS, which are stored as extended attributes xattrs, do not use the credentials captured when the SMB handle was opened...

Linux Distros Unpatched Vulnerability : CVE-2026-64401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then us...

Linux Distros Unpatched Vulnerability : CVE-2026-64391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS...

Linux Distros Unpatched Vulnerability : CVE-2026-64381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs...

Linux Distros Unpatched Vulnerability : CVE-2026-64398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after...

Linux Distros Unpatched Vulnerability : CVE-2026-64387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If...

Oracle Linux 7 : samba (ELSA-2026-28132)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-28132 advisory. - Fix CVE-2026-4408 and CVE-2026-4480 Orabug: 39599120 Tenable has extracted the preceding description block directly from the Oracle Linux security...

pentest-exploitation-lab-notes

Penetration Testing Lab Notes CyberShield Security — Junior...

MiracleLinux 9 : samba-4.23.5-10.el9_8 (AXSA:2026-1321:09)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1321:09 advisory. samba: Missing access check on reparse point operations CVE-2026-1933 samba: vfsworm does not block directory modification CVE-2026-2340 samba: grou...

samba security update

4.10.16-25.0.11 - Fix CVE-2026-4408 and CVE-2026-4480 Orabug: 39599120 4.10.16-25.0.9 - s3:winbindd: avoid using any netlogon call to get a dc name Orabug: 38560263 - winbindd: use finddomainfromnamenoinit in finddnsdomainname Orabug: 38560263 4.10.16-25.0.7 - Fixed winbind dsgetdcname calls w.r....

[SECURITY] [DLA 4692-1] samba security update

Debian LTS Advisory DLA-4692-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany July 21, 2026 https://wiki.debian.org/LTS Package : samba Version : 2:4.13.13+dfsg-1deb11u8 CVE ID : CVE-2026-2340 CVE-2026-3012 CVE-2026-3238 CVE-2026-4408 CVE-2026-4480 Several...

Debian dla-4692 : ctdb - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4692 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4692-1 [email protected]...