EUVD-2026-81777

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

CVE-2026-90184

CVE-2026-90184 is a race condition in the Linux kernel's null_blk block device driver. Configfs attribute store methods (e.g., for zoned) run concurrently with null_add_dev() without holding a lock, allowing device configuration to change mid-setup. This can lead to a failed device setup (-EIO vi...

CVE-2026-90184 null_blk: serialize configfs attribute updates with device setup

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

CVE-2026-90184 null_blk: serialize configfs attribute updates with device setup

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

EUVD-2026-81765

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

CVE-2026-90172 smb: smbdirect: destroy QP before mem pools on accept failure

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

CVE-2026-90172

CVE-2026-90172 affects the SMB Direct (smbdirect) RDMA module in the Linux kernel . On the rdma_accept_failed error path of smbdirect_accept_connect_request(), memory pools and the recv_io slab cache were destroyed before the QP was drained via ib_drain_qp(). This left an outstanding recv_io obje...

CVE-2026-90172 smb: smbdirect: destroy QP before mem pools on accept failure

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

EUVD-2026-81759

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90165 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90165 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

EUVD-2026-81758

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90166 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90165

CVE-2026-90165 is an invalid pointer dereference in the Linux kernel's ksmbd (SMB server) subsystem. The root cause is in ksmbd_launch_ksmbd_durable_scavenger(): when kthread_run() fails, server_conf.dh_task is set to an ERR_PTR() while durable_scavenger_running remains true . A subsequent call t...

CVE-2026-90164

CVE-2026-90164 affects the ksmbd (SMB server) subsystem in the Linux kernel . The root cause is that ksmbd_proc_init() returns void after a procfs or percpu_counter allocation failure, causing ksmbd_server_init() to continue with NULL per-CPU counters. On SMP systems , this leads to a NULL pointe...

CVE-2026-90164 smb/server: abort initialization when proc setup fails

In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems. ksmbdprocinit tears down partial state on a procfs or percpucounter...

CVE-2026-90156

CVE-2026-90156 affects the ksmbd (SMB server) module in the Linux kernel . The vulnerability is a NULL pointer dereference in the lock rollback path: when vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on the rollback list before allocating and registering the asynchronous work....

EUVD-2026-81749

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-90156 ksmbd: safely discard unregistered deferred locks

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

CVE-2026-90156 ksmbd: safely discard unregistered deferred locks

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...