CVE-2026-98174

The Linux kernel contains a vulnerability in the SMB client related to the TCP_Server_Info.rlist structure. The issue stems from using kzalloc, which incorrectly initializes ->next and ->prev pointers to NULL instead of pointing to the structure itself, causing list_empty() to return false ...

EUVD-2026-93101

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98173

The Linux kernel contains a use-after-free vulnerability in the SMB client component within the cifs_try_adding_channels() function. The issue occurs because the function captures the next entry in ses->iface_list while holding iface_lock, but then drops the lock during cifs_ses_add_channel()....

EUVD-2026-93100

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession error When an RDMA connection is successfully established via smbdgetconnection but cifsgettcpsession later fails e.g. kthreadcreate returns an error, the error path frees...

CVE-2026-98172

The Linux kernel contains a vulnerability in the SMB client where an smbd_connection leak occurs. When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() subsequently fails (for example, if kthread_create() returns an error), the error path incorre...

CVE-2026-98171

The Linux kernel contains a vulnerability in the SMB client 's handling of compound encrypted frames within the receive_encrypted_standard() function. The issue stems from pointer lifecycle errors and insufficient bounds checking. Specifically, a use-after-free can occur because next_buffer is no...

EUVD-2026-93099

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

CVE-2026-98170

The Linux kernel contains an out-of-bounds read vulnerability in the smb: client component within the move_smb2_ea_to_cifs() function. The root cause is an insufficient loop condition (while (src_size > 0)) that allows iteration to continue even when the remaining src_size is too small to hold...

EUVD-2026-93098

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

CVE-2026-98169

The Linux kernel contains an out-of-bounds (OOB) read vulnerability in the smb3_enum_snapshots() function of the SMB client. The issue arises because the function fails to verify the actual length of a server's reply when snapshot_array_size is smaller than GMT_TOKEN_SIZE. Since SMB2_ioctl() does...

EUVD-2026-93097

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98168

The Linux kernel contains a vulnerability in the SMB client component within the cifs_query_reparse_point() function. The root cause is an insufficient bounds check where the code verifies that the start pointer is within the response but fails to ensure at least 8 bytes remain for the reparse_da...

EUVD-2026-93096

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2026-98167

The Linux kernel SMB client contains a vulnerability in receive_encrypted_standard() where server->total_read incorrectly maintains the full decrypted frame size while processing sub-PDUs of a compound encrypted frame . This oversight causes cifs_handle_standard() to pass an incorrect size to ...

EUVD-2026-93095

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...

EUVD-2026-93094

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

CVE-2026-98166

The Linux kernel contains a vulnerability in the drm/ttm component where swapped-out resources fail to leave their bulk_move range. The root cause is that a previous commit incorrectly moved bookkeeping logic, causing the ttm_resource_del_bulk_move_unevictable() and ttm_resource_move_to_lru_tail(...

CVE-2026-98165

The Linux kernel 's drm/amdgpu driver contains a vulnerability related to the BAR0 fallback read path. This path was originally implemented as a workaround for SR-IOV VFs where the VRAM aperture is unavailable during early initialization. The fix involves restricting this workaround specifically ...

EUVD-2026-93093

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only The BAR0 fallback read path was introduced as a workaround for SR-IOV VFs where the VRAM aperture is not available during early init. Restrict this workaround to only...

cve-2026-46331-audit

cve-2026-46331-audit -7.8%20HIGH-orange?style=flat-square Read-only audit script for CVE-2026-46331 a.k.a. pedit COW — a partial copy-on-write bug in the Linux kernel's net/sched actpedit action that lets a local unprivileged user corrupt page cache memory and escalate to root. | | | \ | | / / \ ...