CVE-2026-97563 smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...

CVE-2026-97564

The Linux kernel contains a vulnerability in the SMB client where the cifs.idmap key type lacks a vet_description hook. This allows userspace to create keys via request_key(2) or add_key(2) containing authority-bearing fields (such as SIDs and uid/gid values) that are improperly treated as kernel...

CVE-2026-97564 smb: client: reject userspace cifs.idmap descriptions

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

CVE-2026-97564 smb: client: reject userspace cifs.idmap descriptions

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

EUVD-2026-86872

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

CVE-2026-97561 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

CVE-2026-97562 smb: client: pin DFS superblock in iterator callback

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

CVE-2026-97560 smb: client: fix one-byte OOB read in smb2_parse_native_symlink()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

CVE-2026-97558 smb: client: fix cifsFileInfo reference leak in deferred close

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

CVE-2026-97559 smb: client: fail DACL rewrite when the new DACL exceeds 64K

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

CVE-2026-97557 smb: client: avoid leaking refcount in cifs_queue_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97556 smb: client: avoid leaking refcount when cifs_sb_tlink() fails

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97554 smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

CVE-2026-97553 xfs: lock the healthmon when inserting unmount event

In the Linux kernel, the following vulnerability has been resolved: xfs: lock the healthmon when inserting unmount event LOLLM complains that xfshealthmonunmount does an unlocked insert of the unmount event into the health monitor's event list. Fix that...

CVE-2026-97551 xfs: initialise args->total for parent pointer updates

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

CVE-2026-97552 xfs: initialise error in xfs_defer_finish_one()

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfsdeferfinishone xfsdeferfinishone declares error without an initialiser and only assigns it inside the loop over dfp-dfpwork. When that list is empty the loop body never runs, control falls through to t...

CVE-2026-97550 xfs: fix unit conversions in per_binval computation

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

CVE-2026-97549 xfs: fix under-reservation of blocks when repairing sf directories

In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS="-n size=8192", I observed the following trimmed dmesg splat: XFS: Assertion failed: args-total =...