EUVD-2026-45804

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-64119 l2tp: use list_del_rcu in l2tp_session_unhash

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-64119

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-64119

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-64016 ksmbd: fix durable reconnect error path file lifetime

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...

EUVD-2026-45589

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...

CVE-2026-64016

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...

CVE-2026-64016

CVE-2026-64016 : In the Linux kernel, the ksmbd durable reconnect path could mismanage file objects when a later error path occurred after a successful durable reconnect. Specifically, ksmbd_reopen_durable_fd() republished the same ksmbd_file into the session volatile-id table, and if smb2_open()...

CVE-2026-64016 ksmbd: fix durable reconnect error path file lifetime

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...

EUVD-2026-45691

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcountincnotzero in l2tpsessiongetbyifname A reader in l2tpsessiongetbyifname can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcountinc, but every other...

CVE-2026-63918

CVE-2026-63918 documents a Linux kernel fix: l2tp_session_get_by_ifname previously used refcount_inc() while other getters used refcount_inc_not_zero(), risking use-after-free if a race during RC/Rcu grace period allowed a zero refcount. The change normalizes the getter to refcount_inc_not_zero()...

CVE-2026-63918

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcountincnotzero in l2tpsessiongetbyifname A reader in l2tpsessiongetbyifname can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcountinc, but every other...

CVE-2026-63918 l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcountincnotzero in l2tpsessiongetbyifname A reader in l2tpsessiongetbyifname can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcountinc, but every other...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

EUVD-2026-45505

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-53383

The CVE-2026-53383 issue affects the Linux kernel’s ksmbd component where a COMPOUND request could bypass validation of the session state. Specifically, smb2_check_user_session() reused work->sess for operations beyond the first in a COMPOUND, validating only SessionId and not rechecking work-...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-53383 ksmbd: reject non-VALID session in compound request branch

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-53383 ksmbd: reject non-VALID session in compound request branch

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...