CVE-2026-64431

Summary of CVE-2026-64431 (Linux kernel NTFS driver): A memory corruption vulnerability arises when post_write_mst_fixup() is called for an invalid index_block after ntfs_ib_write() returns an error. The root cause is that ntfs_icx_ib_sync_write() treated any error as a write failure and invoked ...

CVE-2026-64431 ntfs: avoid calling post_write_mst_fixup() for invalid index_block

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

CVE-2026-64431

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

EUVD-2026-48945

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

CVE-2026-64401 smb: client: resolve SWN tcon from live registrations

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

CVE-2026-64401

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

CVE-2026-64396

CVE-2026-64396 concerns the Linux kernel ksmbd subsystem. A use-after-free (UAF) of a struct file_lock can occur during SMB2_LOCK deferred-lock cancellation when a blocking byte-range lock is deferred and the asynchronous work is canceled concurrently. The root cause is a race between de‑queuing ...

CVE-2026-64396 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...

CVE-2026-64396 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...

EUVD-2026-48937

In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SETINFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the...

CVE-2026-64391 ksmbd: use opener credentials for ADS I/O

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...

EUVD-2026-48934

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64388

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

EUVD-2026-48932

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

CVE-2026-64387

Summary (CVE-2026-64387) : The Linux kernel SMB client is affected by a replay-double-free condition in query directory handling. If SMB2_query_directory_init() fails before the next send, a previously freed response buffer could be freed again due to stale bookkeeping, potentially compromising c...

EUVD-2026-48931

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

EUVD-2026-48930

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64386 smb: client: fix query_info() replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64386 smb: client: fix query_info() replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64385 smb: client: fix double-free in SMB2_ioctl() replay

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...