CVE-2026-98172 smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession error When an RDMA connection is successfully established via smbdgetconnection but cifsgettcpsession later fails e.g. kthreadcreate returns an error, the error path frees...

CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

EUVD-2026-93098

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

CVE-2026-98170

The Linux kernel contains an out-of-bounds read vulnerability in the smb: client component within the move_smb2_ea_to_cifs() function. The root cause is an insufficient loop condition (while (src_size > 0)) that allows iteration to continue even when the remaining src_size is too small to hold...

EUVD-2026-93099

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

CVE-2026-98171

The Linux kernel contains a vulnerability in the SMB client during the handling of compound encrypted frames within the receive_encrypted_standard() function. The issue stems from several pointer lifecycle and bounds checking flaws: a stale next_buffer pointer can lead to a use-after-free on cert...

CVE-2026-98171 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

CVE-2026-98171 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

EUVD-2026-93097

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98169

A vulnerability exists in the Linux kernel 's SMB client where the smb3_enum_snapshots() function fails to verify the actual length of a server's reply. Specifically, if snapshot_array_size is smaller than GMT_TOKEN_SIZE, the function sets ret_data_len to the size of struct smb_snapshot_array. Si...

CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

EUVD-2026-93096

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2026-98168

The Linux kernel contains a vulnerability in the SMB client component within the cifs_query_reparse_point() function. The root cause is an insufficient bounds check where the code verifies that the start pointer is within the response but fails to ensure at least 8 bytes remain for the reparse_da...

CVE-2026-98168 smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2026-98168 smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2026-98167 smb: client: fix server->total_read for compound encrypted PDUs

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...

CVE-2026-98167

The Linux kernel SMB client contains a vulnerability in receive_encrypted_standard() where server->total_read incorrectly maintains the full decrypted frame size while processing sub-PDUs of a compound encrypted frame . This oversight causes cifs_handle_standard() to pass an incorrect size to ...

EUVD-2026-93095

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...