Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: When a multichannel SMB2SESSIONSETUP request with SMB2SESSIONREQFLAGBINDING fails, ksmbd sets conn-binding = true, but never clears this value during the error path. As a result, the connection remains in a binding state,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not allow guest users on multi-channel connections. This patch returns STATUSNOTSUPPORTED if the binding session is a guest session...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not expire a session when a binding attempt fails. When a multichannel session binding request fails e.g., due to an incorrect password, the error path unconditionally sets sess-state to SMB2SESSIONEXPIRED. However,...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel. A race condition between the smb2 close operation and logoff in multi-channel connections could lead to a use-after-free issue...

CVE-2026-72044

A flaw was found in ksmbd in the Linux kernel. A stack buffer overflow vulnerability exists in the multichannel session-key copy mechanism. A remote attacker can exploit this by supplying a crafted session key larger than the intended buffer size during a binding session setup. This can lead to a...

SUSE CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74521

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74521 ksmbd: use memcmp() to compare ClientGUIDs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

EUVD-2026-59714

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74521

The CVE-2026-74521 vulnerability affects the Linux kernel’s ksmbd component, where ClientGUIDs were compared with strncmp() and could misclassify distinct GUIDs that contain embedded NUL bytes. The fix uses memcmp() to compare all SMB2_CLIENT_GUID_SIZE bytes in SMB3 multichannel session binding a...

CVE-2026-74521 ksmbd: use memcmp() to compare ClientGUIDs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

UBUNTU-CVE-2026-72044

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-72044 ksmbd: fix stack buffer overflow in multichannel session-key copy

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sesskey CIFSKEYSIZE...

PT-2026-72973

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-19387

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

SUSE CVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

SUSE CVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...

CVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths,...