CVE-2026-64382

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

CVE-2026-64383

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifssendrecv stores a replacement...

CVE-2026-64379

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

CVE-2026-64269

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

UBUNTU-CVE-2026-64381

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs already reached MAXCOMPOUND. If the limit check fails, the function...

CVE-2026-64257

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

CVE-2026-64298

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...

CVE-2026-64379

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

UBUNTU-CVE-2026-64379

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

CVE-2026-64384

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2notifyinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64387

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

UBUNTU-CVE-2026-64401

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

UBUNTU-CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

UBUNTU-CVE-2026-64384

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2notifyinit fails before the next send, cleanup retains the previous buffer type and...

UBUNTU-CVE-2026-64257

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

UBUNTU-CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

UBUNTU-CVE-2026-64269

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

CVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

UBUNTU-CVE-2026-64388

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

UBUNTU-CVE-2026-64383

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifssendrecv stores a replacement...