CVE-2026-62428

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation a mapping or another copy. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant the grant is "pinned", what is...

CVE-2026-62427

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

CVE-2026-62426

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

CVE-2026-62428 grant-table: type confusion in grant-copy

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation a mapping or another copy. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant the grant is "pinned", what is...

CVE-2026-62428

When grant-copy operations are processed, the respective grant may or...

CVE-2026-62428

CVE-2026-62428 describes a type-confusion in grant-copy handling where a grant may be 'pinned' to one operation, causing the permission check and copy operation to reference potentially different guest frames. This could lead to inconsistencies and incorrect permission checks. Documented impact i...

CVE-2026-62428

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation a mapping or another copy. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant the grant is "pinned", what is...

EUVD-2026-49779

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation a mapping or another copy. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant the grant is "pinned", what is...

CVE-2026-62426

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

CVE-2026-62427

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

CVE-2026-62427 sysctl and platform-op locks open to abuse

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

CVE-2026-62427

CVE-2026-62427 affects Xen environments where sysctl and platform-op locks are used in the control domain or Xenstore domain. The issue arises from non-fair system-wide locks and, with XSM/Flask, lock acquisition occurring before permission checks, enabling abuse that can lead to a Denial of Serv...

UBUNTU-CVE-2026-64391

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...

UBUNTU-CVE-2026-64399

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via vfsclonefilerange with neither the share-level KSMBDTREECONNFLAGWRITABLE che...

SUSE CVE-2026-64391

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...

SUSE CVE-2026-64399

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via vfsclonefilerange with neither the share-level KSMBDTREECONNFLAGWRITABLE che...

CVE-2026-64399

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via vfsclonefilerange with neither the share-level KSMBDTREECONNFLAGWRITABLE che...

CVE-2026-64392

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run...

CVE-2026-64399

Summary: CVE-2026-64399 affects the Linux kernel ksmbd path for FSCTL_DUPLICATE_EXTENTS_TO_FILE. The vulnerability allows overwriting a destination file’s data via vfs_clone_file_range() because both the share-level KSMBD_TREE_CONN_FLAG_WRITABLE check and a per-handle daccess check were absent, a...

EUVD-2026-48943

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via vfsclonefilerange with neither the share-level KSMBDTREECONNFLAGWRITABLE che...