DEBIAN-CVE-2026-64140

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in procshowfiles When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSIONLOGOFF, sessionfdcheck clears fp-tcon = NULL on the reconnectable file pointer but leaves t...

CVE-2026-64138

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

DEBIAN-CVE-2026-64105

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64034

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...

CVE-2026-63874

creationtimestamp| type| source ---|---|--- 2026-07-19 15:59:00+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqz5j5drks24...

CVE-2026-64139

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix SID memory leak in setposixaclentriesdacl on overflow Commit 299f962c0b02 "ksmbd: use checkaddoverflow to prevent u16 DACL size overflow" added checkaddoverflow guards that break out of the ACE-building loops in...

EUVD-2026-45823

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

CVE-2026-64138

CVE-2026-64138 affects the ksmbd component in the Linux kernel, addressing a vulnerability in ACL inheritance where the Owner/Group SIDs from the NT Security Descriptor could be unsafe when retrieved from a parent directory. The fix introduces the helper smb_validate_ntsd_sid() to safely validate...

CVE-2026-64138 ksmbd: validate SID in parent security descriptor during ACL inheritance

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

CVE-2026-64138

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

CVE-2026-64138

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smbvalidatentsdsid helper to safely validate Owner SID and Group SID inside the NT Security Descriptor smbntsd retrieved from the parent directory...

EUVD-2026-45791

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64106

Linux kernel KVM arm64 vgic-its vulnerability: a userspace process can restore an ITS Device Table Entry with a Size encoding more EventID bits than the virtual ITS supports. Although MAPD rejects the state, vgic_its_restore_dte() stores the out-of-range value in dev->num_eventid_bits, allowin...

CVE-2026-64106 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64081 firmware: arm_ffa: Validate framework notification message layout

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

CVE-2026-64081 firmware: arm_ffa: Validate framework notification message layout

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

CVE-2026-64048 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini-ismdev/ini-ismchid is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt populates V2 entries starting at index 1, so when no ...

EUVD-2026-45603

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...

CVE-2026-64023 gpio: aggregator: fix a potential use-after-free

In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr-lookups-devid before removing the entry from the lookup table. If a concurrent thread calls gpiodfind before we remove the entry, it could iterate over the li...

CVE-2026-64016 ksmbd: fix durable reconnect error path file lifetime

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...