EUVD-2026-86866

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

CVE-2026-97558 smb: client: fix cifsFileInfo reference leak in deferred close

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

CVE-2026-97558

The Linux kernel contains a vulnerability in the SMB client where a cifsFileInfo reference leak occurs during a deferred close operation. The issue stems from a race condition in cifs_close(): if deferred_close_scheduled becomes false while work is pending, subsequent cifs_open() calls may reuse ...

EUVD-2026-86867

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

EUVD-2026-86864

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

CVE-2026-97556

The Linux kernel contains a vulnerability in the SMB client where a reference count leak occurs when cifs_sb_tlink() fails, specifically in setups using the "-o multiuser" option. The cifs_oplock_break() function fails to release the file reference in this specific failure path, which can lead to...

EUVD-2026-86865

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97557

The Linux kernel contains a vulnerability in the CIFS (SMB) client where cifs_queue_oplock_break() unconditionally increments a file reference count before attempting to queue cifs_oplock_break(). If the work item is already queued, queue_work() returns false, causing the reference count to leak....

CVE-2026-97557 smb: client: avoid leaking refcount in cifs_queue_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

EUVD-2026-86863

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555

A heap overflow vulnerability exists in the Linux kernel 's SMB client within the DACL owner/group rewrite process. When id_mode_to_cifs_acl rewrites an existing DACL, it incorrectly allocates a buffer based on the on-disk length. If the replacement SIDs obtained from the cifs.idmap upcall are lo...

CVE-2026-97554 smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

EUVD-2026-86862

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

EUVD-2026-86861

In the Linux kernel, the following vulnerability has been resolved: xfs: lock the healthmon when inserting unmount event LOLLM complains that xfshealthmonunmount does an unlocked insert of the unmount event into the health monitor's event list. Fix that...

CVE-2026-97554

A vulnerability exists in the Linux kernel SMB client within the cifs_posix_to_fattr() function. The issue stems from the function ignoring the return value of posix_info_parse() . When processing a malformed POSIX directory entry from an untrusted server (such as one with invalid SID lengths), t...

CVE-2026-97553

The Linux kernel contains a vulnerability in the xfs filesystem component. Specifically, the function xfs_healthmon_unmount performs an unlocked insert of the unmount event into the health monitor's event list . The fix involves properly locking the healthmon during this insertion to ensure threa...

CVE-2026-97552

The Linux kernel contains a vulnerability in the xfs filesystem where xfs_defer_finish_one() declares an error variable without an initialiser. If the dfp->dfp_work list is empty, the loop body is skipped, and the function returns an indeterminate value . This occurs when xfs_reap_ag_blocks() ...

EUVD-2026-86860

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfsdeferfinishone xfsdeferfinishone declares error without an initialiser and only assigns it inside the loop over dfp-dfpwork. When that list is empty the loop body never runs, control falls through to t...

EUVD-2026-86859

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...