CVE-2026-64382 smb: client: fix double-free in SMB2_open() replay

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

EUVD-2026-48926

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

CVE-2026-64382

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

CVE-2026-64382 smb: client: fix double-free in SMB2_open() replay

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

CVE-2026-64380 smb: client: harden POSIX SID length parsing

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

EUVD-2026-48924

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64380

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64380 smb: client: harden POSIX SID length parsing

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64380

The CVE-2026-64380 issue affects the Linux kernel SMB client path handling of POSIX SIDs. The root cause is in posix_info_sid_size(), which reads sid[1] to obtain the subauthority count but previously allowed buffers with only one remaining byte, potentially enabling unsafe rejection of truncated...

CVE-2026-64379 smb: client: mask server-provided mode to 07777 in modefromsid

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

CVE-2026-64379 smb: client: mask server-provided mode to 07777 in modefromsid

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

EUVD-2026-48923

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

CVE-2026-64298 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...

EUVD-2026-49010

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...

CVE-2026-64281 svcrdma: wake sq waiters when the transport closes

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

CVE-2026-64269

The CVE-2026-64269 issue affects the Linux kernel’s RDMA path (RDMA/rtrs-srv) where rdma_write_sg() uses desc[0].len from the wire descriptor to determine the RDMA_WRITE length. The length could exceed the bound of the mapped chunk because it wasn’t checked against max_chunk_size, enabling a peer...

CVE-2026-64269

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

EUVD-2026-48981

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

CVE-2026-64257 smb: client: reject overlapping data areas in SMB2 responses

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

EUVD-2026-48969

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...