CVE-2026-64392

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run...

CVE-2026-64391

The CVE-2026-64391 issue affects the Linux kernel ksmbd component, where alternate data streams (ADS) stored as xattrs were read/written using current task credentials via VFS xattr paths. The root cause is that ADS I/O did not use the credentials captured when the SMB handle was opened, allowing...

CVE-2026-64390

The CVE-2026-64390 issue affects the Linux kernel ksmbd component where SMB2_LOCK locks are tracked on the file lock list and the lock list of the handling connection. With SMB3 multichannel, the LOCK owner can differ from the file opener, so a lock entry can be removed under a different spinlock...

EUVD-2026-48934

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64390 ksmbd: track the connection owning a byte-range lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

EUVD-2026-48933

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

CVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

CVE-2026-64389 ksmbd: validate NTLMv2 response before updating session key

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

PT-2026-64610

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the ksmbd auth ntlmv2 function derives the NTLMv2 session key into sess-sess key before verifying the NTLMv2 response. Subsequently, ksmbd decod...

PT-2026-64615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the ksmbd module contains a permission bypass. The smb2 set info sec function calls set info sec without performing a per-handle access check. This allows a client t...

PT-2026-64614

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, SMB2 SET INFO handlers call path-based VFS Virtual File System helpers after verifying the access mask of the SMB handle. These helpers perform owner, inode...

PT-2026-64621

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A path traversal bypass exists in the ksmbd component. The ksmbd vfs path lookup function uses LOOKUP BENEATH to restrict path resolution to the share root. While vfs path parent lookup...

Linux Distros Unpatched Vulnerability : CVE-2026-64400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: prevent path traversal bypass by restricting caseless retry ksmbdvfspathlookup enforces LOOKUPBENEATH to restrict path resolution within the share root...

Linux Distros Unpatched Vulnerability : CVE-2026-64394

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 ksmbd: fix FSCTL permission bypass by adding a permission check for...

Linux Distros Unpatched Vulnerability : CVE-2026-64397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack- allocated private data in the ksmbdfile readdirdata. Concurrent...

Linux Distros Unpatched Vulnerability : CVE-2026-64395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange...

PT-2026-64617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ksmbd component during the cancellation of deferred locks in the SMB2 LOCK path. When a blocking byte-range lock request is deferred, the system...

Linux Distros Unpatched Vulnerability : CVE-2026-64399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via...

Linux Distros Unpatched Vulnerability : CVE-2026-64396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd...