CVE-2022-2078

CVE-2022-2078 root@kitploit: $ ./poc ... + getset leakbuffer: 0000 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;? 0010 28 00 00 00 00 02 0a 8f 68 8b a2 be 40 ac 70 8c [email protected]. 0020 ff ff ff ff 00 6c b5 81 .....l.. + kernel=0xffffffff8c70ac40...

Linux Distros Unpatched Vulnerability : CVE-2026-89637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix UAF and buffer leak in cifschecktrans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-respbuf set,...

CVE-2026-89637

A flaw was found in the Linux kernel's Server Message Block SMB client. When processing a malformed secondary TRANSACT2 response, a use-after-free UAF vulnerability and a buffer leak can occur in the cifschecktrans2 function. This can lead to a dangling buffer being reused by the demux thread,...

CVE-2026-89637

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifschecktrans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-respbuf set, mid-multiRsp true and a subsequent secondary response causes...

DEBIAN-CVE-2026-89637

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifschecktrans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-respbuf set, mid-multiRsp true and a subsequent secondary response causes...

AZL-100694 CVE-2026-89637 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifschecktrans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-respbuf set, mid-multiRsp true and a subsequent secondary response causes...

CVE-2026-89637

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifschecktrans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-respbuf set, mid-multiRsp true and a subsequent secondary response causes...

CVE-2026-89637

CVE-2026-89637 is a use-after-free (UAF) and buffer leak in the Linux kernel SMB client , specifically in the cifs_check_trans2() function. When a valid primary TRANSACT2 response is followed by a malformed secondary response, handle_mid() overwrites mid->resp_buf without releasing the primary...

CVE-2026-89637 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifschecktrans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-respbuf set, mid-multiRsp true and a subsequent secondary response causes...

EUVD-2026-76549

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifschecktrans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-respbuf set, mid-multiRsp true and a subsequent secondary response causes...

CVE-2026-89637 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifschecktrans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-respbuf set, mid-multiRsp true and a subsequent secondary response causes...

PT-2026-90353

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs check trans2 for malformed secondary T2 When a valid primary TRANSACT2 response has been received mid-resp buf set, mid-multiRsp true and a subsequent secondary response causes cifs...

CVE-2026-42806

An out-of-bounds read vulnerability exists in the Bosch BME690 SensorAPI C-driver (v1.0.3 and prior) within the read_all_field_data function (bme69x.c). The driver prefetches heater configuration registers into a 30-byte stack buffer, but the gas_index field is extracted with a 4-bit mask (0–15) ...

PT-2026-86452

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description An unauthenticated client can initiate an IPv4 UDP test by exploiting a state where the system accepts a related btest connectio...

SUSE CVE-2026-72466

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdmaisbcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, a leak in the skbtstamptx function was fixed. Commit 50749f2dd685 “tcp/udp: Fixed memory leaks in sk and zerocopy skbs during TX timestamping” added a call to skborphanfragsrx, to fix leaks related to zeroco...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: i2c: Fixed a skb memory leak in the receive path. When midev-allowrx is set to false, the newly allocated skb is not consumed by netifrx. It is necessary to free the skb directly...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mxser: fixed the xmitbuf leak in activate when LSR == 0xff. When LSR is 0xff during the call to -activate, we return an error. It is ensured that the -shutdown method is not called when -activate fails; otherwise, nothing actuall...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: cdceem: Fix for the “tx fixupskb leak” issue. When usbnet transmit sends a skb, it is handled in eemtxfixup. If skbcopyexpand fails, it returns NULL. In this case, usbnetstartxmit has no chance to free the original skb. The...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: serial: sprd: Fixed the DMA buffer leak issue. Release the DMA buffer when probe returns an error to avoid memory leaks...