CVE-2026-72044

A flaw was found in ksmbd in the Linux kernel. A stack buffer overflow vulnerability exists in the multichannel session-key copy mechanism. A remote attacker can exploit this by supplying a crafted session key larger than the intended buffer size during a binding session setup. This can lead to a...

CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74521 ksmbd: use memcmp() to compare ClientGUIDs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

EUVD-2026-59714

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74521 ksmbd: use memcmp() to compare ClientGUIDs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74521

The CVE-2026-74521 vulnerability affects the Linux kernel’s ksmbd component, where ClientGUIDs were compared with strncmp() and could misclassify distinct GUIDs that contain embedded NUL bytes. The fix uses memcmp() to compare all SMB2_CLIENT_GUID_SIZE bytes in SMB3 multichannel session binding a...

UBUNTU-CVE-2026-72044

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-72044 ksmbd: fix stack buffer overflow in multichannel session-key copy

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sesskey CIFSKEYSIZE...

PT-2026-72973

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Added channlock to protect the ksmbdchannlist xarray. The ksmbdchannlist xarray lacks synchronization, allowing use-after-free situations in multi-channel sessions between lookupchannlist and ksmbdchanndel. Added a...

CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

SUSE CVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

SUSE CVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64390 ksmbd: track the connection owning a byte-range lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

EUVD-2026-48934

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64390 ksmbd: track the connection owning a byte-range lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64389

Summary: CVE-2026-64389 affects the Linux kernel KSMD (ksmbd) SMB3 multichannel binding path. The code derives the NTLMv2 session key into sess->sess_key during ksmbd_auth_ntlmv2(), before validating the NTLMv2 response. If authentication fails, the subsequent KEY_XCH step may still use the (p...