CVE-2026-89649

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

EUVD-2026-76562

In the Linux kernel, the following vulnerability has been resolved: ceph: bound numexporttargets array for mds info v2/v3 cephmdsmapdecode in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeofu32 without first checking...

CVE-2026-89634

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

CVE-2026-89633

CVE-2026-89633 is a critical (CVSS 9.8) vulnerability in the Linux kernel's SMB client , specifically in the coalesce_t2() function. The root cause is that server-supplied DataOffset fields are used to compute data pointers without any validation against buffer boundaries. A small DataOffset valu...

CVE-2026-89633

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

CVE-2026-89634 smb: client: fix ALIGN() overflow in symlink_data() error context loop

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

CVE-2026-89633 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

CVE-2026-89633 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

CVE-2026-89632

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89632

CVE-2026-89632 is an out-of-bounds read in the Linux kernel's SMB client , specifically in the reparse_buf_ptr() function. The root cause is a use-before-check of ReparseDataLength (offset 4, 2 bytes): the value is read before verifying that the received buffer length (count) is at least the full...

CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

EUVD-2026-76544

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

EUVD-2026-76543

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631

CVE-2026-89631 affects the Linux kernel SMB (CIFS) client . In CIFSTCon(), the strnlen() bound over the byte area uses the server's ByteCount minus two; when ByteCount is 0 or 1, the value underflows to a huge size_t, causing cifs_strndup_from_utf16() to read up to 65,535 bytes past the ~16 KB sl...

CVE-2026-89629 HID: corsair-void: Check size of status and firmware events before reading them

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

CVE-2026-89628

A slab-out-of-bounds read vulnerability exists in the Linux kernel's hid_picolcd driver. The function picolcd_debug_eeprom_read() trusts a length byte supplied by the device in its REPORT_EE_DATA reply, clamping it only to the caller's read count but never checking resp->raw_size—the actual nu...

CVE-2026-89629 HID: corsair-void: Check size of status and firmware events before reading them

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...