CVE-2026-64401 smb: client: resolve SWN tcon from live registrations

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

EUVD-2026-48945

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

CVE-2026-64388

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

CVE-2026-64387 smb: client: fix query directory replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

CVE-2026-64387 smb: client: fix query directory replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

CVE-2026-64386 smb: client: fix query_info() replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64386

CVE-2026-64386 : In the Linux kernel SMB client, a replayable error could free the prior response buffer when SMB2_query_info_init() fails before the next send, causing a double-free. The fix resets response bookkeeping before each attempt to prevent stale frees. Affected component is the SMB cli...

CVE-2026-64385

The CVE-2026-64385 entry relates to a Linux kernel SMB client double-free in SMB2_ioctl() replay. The underlying issue is a stale buffer being freed twice when an SMB2_ioctl_init() path fails before the next send; the fix resets response bookkeeping before each attempt to prevent the stale free. ...

EUVD-2026-48929

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...

CVE-2026-64383

CVE-2026-64383 affects the Linux kernel’s SMB2 client path, specifically the SMB2_flush() replay handling. The issue arises when a replayable flush response is received and a retry fails before a replacement response is stored, causing a second free of the stale buffer due to persistent bookkeepi...

CVE-2026-64383

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifssendrecv stores a replacement...

EUVD-2026-48927

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifssendrecv stores a replacement...

CVE-2026-64381

The CVE-2026-64381 issue is in the Linux kernel SMB client code path used by receive_encrypted_standard()/receive encrypted standard(): a next_buffer is allocated before validating that the number of compound PDUs has not exceeded MAX_COMPOUND. If the limit check fails, the function returns early...

CVE-2026-64381

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs already reached MAXCOMPOUND. If the limit check fails, the function...

CVE-2026-64381 smb: client: Fix next buffer leak in receive_encrypted_standard()

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs already reached MAXCOMPOUND. If the limit check fails, the function...

CVE-2026-64382

CVE-2026-64382 describes a Linux kernel SMB client-use-after-free issue in SMB2_open() replay handling. The vulnerability arises because a response-bearing SMB2_open attempt could return a replayable error and free its response buffer; if SMB2_open_init() fails before the next send, cleanup may f...

CVE-2026-64382 smb: client: fix double-free in SMB2_open() replay

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

CVE-2026-64379

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

CVE-2026-64379

The CVE-2026-64379 issue affects the Linux kernel SMB client: when modefromsid is active, parse_dacl() could apply the server-provided NFS mode SID sub_auth[2] to cf_mode without masking to 07777. The root cause is missing masking in cf_mode; the fix applies the correct masking (07777) the same a...

EUVD-2026-48923

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...