Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in ksmbd within the Linux kernel versions 5.15 through 5.19, prior to 5.19.2. There is a heap-based buffer overflow in the setntacldacl function, which is related to the use of the SMB2QUERYINFOHE function after an incorrectly formatted SMB2SETINFOHE command...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The issue of a null pointer dereference error in generateencryptionkey has been fixed. If a client sends two session setups with KRB5 authentication to ksmbd, a null pointer dereference error in generateencryptionkey can...

CVE-2026-93786

A flaw was found in the Linux kernel's ksmbd in-kernel Server Message Block component. When creating new files or directories, ksmbd improperly modified inherited Access Control Lists ACLs by overwriting restrictive permission masks. An authenticated user creating objects on an SMB share could...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fixed a use-after-free in cifsoplockbreak. A race condition can occur in cifsoplockbreak, leading to a use-after-free of the cinode structure when unmounting: c cifsoplockbreak cifsFileInfoputcfile cifsFileInfoputfin...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fix deadlock in smb2findsmbtcon Unlock cifstcpseslock before calling cifsputsmbses to avoid such deadlocks...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed a buffer overflow issue when parsing NFS reparse points. ReparseDataLength is the sum of the InodeType size and the DataBuffer size. To obtain the DataBuffer size, it is necessary to subtract the InodeType size fro...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed the issue where a memory leak occurred after the session was logged off. There is an issue with the interaction between SMB2 session logging out and SMB2 session setup. This issue causes a memory leak after the sessi...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fixed a potential Use-after-Free UAF in cifsdumpfullkey. Skipped sessions that are being terminated status == SESEXITING to avoid UAF...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to unset link speed It is not guaranteed that NETWORKINTERFACEINFO::LinkSpeed will always be set by the server. Therefore, the client must handle any possible values and prevent such oopses from occurrin...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: A use-after-free issue was fixed in ksmbdsessionrpcopen. A UAF Use-After-Free issue may occur due to a race condition between ksmbdsessionrpcopen and sessionrpcclose. Adding rpclock to the session can help protect it fr...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevents out-of-bounds stream writes by validating pos. The ksmbdvfsstreamwrite function did not validate whether the write offset pos was within the bounds of the existing stream data length vlen. If pos was greater than ...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The rcubarrier function was called in ksmbdserverexit. The bug is triggered due to racing between closing a connection and the rmmod operation. In ksmbd, rcubarrier is not called at the time of module unloading, so nothing...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: TCP: fixed page frag corruption upon a page fault. Steffen reported a corruption of the TCP stream for HTTP requests served by the Apache web-server, using a CIFS mount-point and the corresponding file’s memory mapping. The root...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: cifs: Fixed an oops due to uninitialized server-smbdconn during reconnection. In smbdDestroy, the server-smbdconn pointer is cleared after freeing the smbdconnection structure it points to, so that reconnection won’t be confused...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel, a high-performance in-kernel SMB server. The specific flaw occurs during the handling of the SMB2TREECONNECT and SMB2QUERYINFO commands. The issue arises from the lack of proper validation of a pointer before accessing it. An...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fixed a potential Use-after-Free UAF in smb2isvalidoplockbreak. Skipped sessions that are being torn down status == SESEXITING to avoid UAF...

Astra Linux – Vulnerability in Linux 6.1

A out-of-bounds read vulnerability was discovered in smb2dumpdetail in the fs/smb/client/smb2ops.c file within the Linux kernel. This issue could allow a local attacker to crash the system or leak internal kernel information...

Astra Linux – Vulnerability in Linux 5.15

A use-after-free flaw was discovered in the smb2isstatusiotimeout function in CIFS within the Linux kernel. After CIFS transfers response data via a system call, there are still local variables pointing to the memory region. If the system call frees those pointers faster than CIFS uses them, CIFS...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: When a multichannel SMB2SESSIONSETUP request with SMB2SESSIONREQFLAGBINDING fails, ksmbd sets conn-binding = true, but never clears this value during the error path. As a result, the connection remains in a binding state,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not log keys during SMB3 signing and encryption key generation. When the KSMBDDEBUGAUTH logging option is enabled, the functions generatesmb3signingkey and generatesmb3encryptionkey log the bytes of the session, signing...