518749 matches found
CVE-2026-90170
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...
EUVD-2026-81763
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...
CVE-2026-90170 ksmbd: validate ipc response length before dereferencing its fields
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...
CVE-2026-90170
CVE-2026-90170 affects the ksmbd SMB server component in the Linux kernel . The root cause is in ipc_validate_msg(), which reads length fields (payload_sz, session_key_len, ngroups) from a response buffer supplied by the userspace ksmbd daemon before verifying the buffer is large enough to contai...
CVE-2026-90170 ksmbd: validate ipc response length before dereferencing its fields
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...
EUVD-2026-81762
In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...
EUVD-2026-81761
In the Linux kernel, the following vulnerability has been resolved: ksmbd: retain connection for pending notify work Deferred CHANGENOTIFY work keeps an async message ID after the original request work is released. A durable handle can outlive its connection, so the connection teardown can destro...
CVE-2026-90169
CVE-2026-90169 affects the ksmbd SMB server in the Linux kernel. In SMB 3.1.1 multichannel binding, a preauth_session object is allocated during the NTLM negotiate phase and is not freed if the client disconnects before sending the authenticate request — neither the authenticate nor error cleanup...
CVE-2026-90168
Removed by vendor...
CVE-2026-90169
In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...
CVE-2026-90168
CVE-2026-90168 affects the ksmbd SMB server component of the Linux kernel . The root cause is a lifetime mismatch: deferred CHANGE_NOTIFY work retains an async message ID after the original request work is released. Because a durable handle can outlive its connection, connection teardown can dest...
CVE-2026-90169 ksmbd: free preauth sessions on connection teardown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...
CVE-2026-90169 ksmbd: free preauth sessions on connection teardown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...
CVE-2026-90167
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pendingbreak wakes that waiter, but without serializing the...
CVE-2026-90167 ksmbd: serialize oplock close with pending break ownership
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pendingbreak wakes that waiter, but without serializing the...
CVE-2026-90167 ksmbd: serialize oplock close with pending break ownership
In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pendingbreak wakes that waiter, but without serializing the...
CVE-2026-90167
CVE-2026-90167 is a race condition in the Linux kernel's ksmbd (SMB server) component. The close operation may abort an in-flight oplock break while another breaker already holds an opinfo reference. Without proper serialization, a waiter can become a new break owner via the test_and_set_bit() fa...
CVE-2026-90166
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...
CVE-2026-90166 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...