40 matches found
PT-2026-116671
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the open cached dir function fails to properly handle errors during compound requests containing CREATE and QUERY INFO commands. If the CREATE...
SUSE CVE-2026-68744
A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...
CVE-2026-68744
A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...
CVE-2026-68744
A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...
CVE-2026-68744
CVE-2026-68744 concerns the SSSD NSS responder. The function sss_nss_protocol_fill_initgr() pre-allocates reply space for all groups but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be sent to the client. This enables a local attacker to disclose cached ...
CVE-2026-68744 Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply
A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...
CVE-2026-68744
A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...
PT-2026-67643
Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description A flaw exists in the NSS responder where the sss nss protocol fill initgr function pre-allocates reply space for all group entries but fails to shrink the packet when groups are skipped. This...
cfids_invalidation_worker() SMB Client DoS
The vulnerability of the cfidsinvalidationworker function in the fs/smb/client/cacheddir.c module of the SMB client kernel in Linux operating systems is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
OESA-2026-1760 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Implement blocking domain This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug...
EUVD-2024-53377
Malicious code in bioql PyPI...
smb: prevent use-after-free due to open_cached_dir error paths
...
fs/smb/client/cached_dir.c Heap Buffer Overflow DoS
The vulnerability of the findorcreatecacheddir function in the fs/smb/client/cacheddir.c module, which is part of the SMB client support in Linux kernel, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...
Linux fs/smb/client/cached_dir.c DoS
The vulnerability in the fs/smb/client/cacheddir.c module of the Linux operating system is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2025-37954
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in opencacheddir with lease breaks A pre-existing valid cfid returned from findorcreatecacheddir might race with a lease break, meaning opencacheddir doesn't consider it valid, and thinks it's...
DEBIAN-CVE-2025-37954
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in opencacheddir with lease breaks A pre-existing valid cfid returned from findorcreatecacheddir might race with a lease break, meaning opencacheddir doesn't consider it valid, and thinks it's...
UBUNTU-CVE-2025-37954
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in opencacheddir with lease breaks A pre-existing valid cfid returned from findorcreatecacheddir might race with a lease break, meaning opencacheddir doesn't consider it valid, and thinks it's...
CVE-2025-37954 smb: client: Avoid race in open_cached_dir with lease breaks
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in opencacheddir with lease breaks A pre-existing valid cfid returned from findorcreatecacheddir might race with a lease break, meaning opencacheddir doesn't consider it valid, and thinks it's...
CVE-2025-37954 smb: client: Avoid race in open_cached_dir with lease breaks
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in opencacheddir with lease breaks A pre-existing valid cfid returned from findorcreatecacheddir might race with a lease break, meaning opencacheddir doesn't consider it valid, and thinks it's...
CVE-2025-37954
CVE-2025-37954 affects the Linux kernel SMB client path, specifically a race in find_or_create_cached_dir/open_cached_dir. A valid cfid returned during find_or_create_cached_dir could race with a lease-break, causing open_cached_dir to treat the cfid as invalid and potentially leak a dentry refer...