EUVD-2026-93105

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as orderbase2q-eopringbuffersize / 4 - 1 But orderbase2 can ...

CVE-2026-98175 smb: client: cancel reconnect work in clean_demultiplex_info()

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98175 smb: client: cancel reconnect work in clean_demultiplex_info()

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98175

The Linux kernel contains a use-after-free vulnerability in the SMB client component. The root cause is that the clean_demultiplex_info() function fails to cancel the server->reconnect delayed work, while it does cancel server->echo. This allows a use-after-free to occur when the demultiple...

EUVD-2026-93103

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98174 smb: client: fix rlist race and missing initialization

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

CVE-2026-98174 smb: client: fix rlist race and missing initialization

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

EUVD-2026-93102

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

CVE-2026-98174

The Linux kernel contains a vulnerability in the smb client due to a race condition and missing initialization. Specifically, TCP_Server_Info.rlist is allocated via kzalloc, which incorrectly sets ->next and ->prev to NULL instead of pointing to the node itself; this causes list_empty() to ...

CVE-2026-98173 smb: client: fix use-after-free of iface in cifs_try_adding_channels()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

EUVD-2026-93101

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98173 smb: client: fix use-after-free of iface in cifs_try_adding_channels()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98173

The Linux kernel contains a use-after-free vulnerability in the SMB client component within the cifs_try_adding_channels() function. The issue arises because the function captures the next entry (niface) under iface_lock but then drops the lock for the duration of cifs_ses_add_channel(). A concur...

CVE-2026-98172 smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession error When an RDMA connection is successfully established via smbdgetconnection but cifsgettcpsession later fails e.g. kthreadcreate returns an error, the error path frees...

EUVD-2026-93100

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession error When an RDMA connection is successfully established via smbdgetconnection but cifsgettcpsession later fails e.g. kthreadcreate returns an error, the error path frees...

CVE-2026-98172

The Linux kernel contains a vulnerability in the SMB client where an smbd_connection leak occurs. When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() subsequently fails (for example, if kthread_create() returns an error), the error path incorre...

CVE-2026-98172 smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession error When an RDMA connection is successfully established via smbdgetconnection but cifsgettcpsession later fails e.g. kthreadcreate returns an error, the error path frees...

CVE-2026-98171 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

CVE-2026-98171

The Linux kernel contains a vulnerability in the SMB client during the handling of compound encrypted frames within the receive_encrypted_standard() function. The issue stems from several pointer lifecycle and bounds checking flaws: a stale next_buffer pointer can lead to a use-after-free on cert...

CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...