CVE-2026-64387

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

UBUNTU-CVE-2026-64387

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

UBUNTU-CVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

EUVD-2026-48941

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64397 ksmbd: serialize QUERY_DIRECTORY requests per file

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64397

CVE-2026-64397 affects the Linux kernel ksmbd component. The issue arises in smb2_query_dir() which stores a pointer to stack-allocated private data in ksmbd_file readdir_data; concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callbac...

CVE-2026-64397 ksmbd: serialize QUERY_DIRECTORY requests per file

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64387

Summary (CVE-2026-64387) : The Linux kernel SMB client is affected by a replay-double-free condition in query directory handling. If SMB2_query_directory_init() fails before the next send, a previously freed response buffer could be freed again due to stale bookkeeping, potentially compromising c...

CVE-2026-64387

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

EUVD-2026-48931

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

CVE-2026-64387 smb: client: fix query directory replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

CVE-2026-64387 smb: client: fix query directory replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

CVE-2026-64302

Summary: CVE-2026-64302 affects the Linux kernel in the x86 memory management code. The root issue is that pagetable_free() was used to free PMD-sized vmemmap pages, but vmemmap pages are not page tables, causing only the first page to be freed and leaking the rest. This was triggered by a commit...

CVE-2026-64296

The CVE concerns the Linux kernel exFAT driver: in exfat_find_dir_entry(), processing directory NAME entries (TYPE_EXTEND) advances the output buffer by a fixed amount while the guard tracks name length, allowing an out-of-bounds read/write when name fragments are long/short. The bug arises becau...

EUVD-2026-49008

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64296 exfat: bound uniname advance in exfat_find_dir_entry()

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-14955

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...

EUVD-2026-48764

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...