CVE-2026-69618

CVE-2026-69618 is an out-of-bounds read in the Windows SMB Client that allows an authorized local attacker to disclose information . The CVSS 3.1 score is 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges required, and high confidentiality impact but no integrity or availabi...

EUVD-2026-73137

Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally...

CVE-2026-69544

CVE-2026-69544 is a heap-based buffer overflow in the Windows SMB Client that allows an authorized attacker with low local privileges to achieve local privilege escalation . The attack vector is local with low complexity and requires no user interaction , rated CVSS 3.1: 7.8 (HIGH) with high impa...

EUVD-2026-73020

Out-of-bounds read in Windows SMB Client allows an authorized attacker to disclose information over a network...

CVE-2026-69572

CVE-2026-69572 is an out-of-bounds read vulnerability in the Windows SMB Client that allows an authorized attacker (low privileges) to disclose information over a network . The CVSS 3.1 score is 5.7 (Medium) with vector AV:N/AC:L/PR:L/UI:R, indicating a network attack with low complexity, low req...

Windows SMB Client Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally...

Windows SMB Client Remote Code Execution Vulnerability

Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network...

CVE-2025-33073

CVE-2025-33073 — Windows SMB クライアント NTLM リフレクション権限昇格 EoP Sentinel AI Defense による調査レポート。防御的分析のみを目的としており、実働するエクスプロイト や PoC は公開されていません。 Windows SMB クライアントの不適切なアクセス制御の欠陥であり、緩和されたと考えられていた NTLM リフレクション技術を 復活させます。攻撃者がホストを強制して高権限の認証コンテキストを自身にリフレクションさせ、NT AUTHORITY\SYSTEM へ権限昇格できるようにします。 📄 完全なレポート:...

kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

A flaw was found in the Linux kernel's Server Message Block SMB client. A missing lock around the tccount increment in the smb2findsmbsesstconunlocked function creates a race condition. This vulnerability, caused by an incomplete refactoring of locking mechanisms, could lead to unexpected behavio...

kernel: smb: client: fix change notify replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability occurs due to a double-free error when handling change notify replies. If a response attempt returns a replayable error and frees its buffer, and then SMB2notifyinit fails, the same buffer can be freed agai...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: smb: client: validate DFS referral PathConsumed

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System DFS referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds...

kernel: smb/client: fix out-of-bounds read in smb2_compound_op()

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2compoundop function, allowing the...

ALSA-2026:64770 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage...

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage...

AlmaLinux 8 : kernel-rt (ALSA-2026:64770)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64770 advisory. kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage CVE-2026-53002 kernel:...

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: can: bcm: add locking for bcmop runtime updates CVE-2025-38004 kernel: iouring/poll: fix signed comparison in iopollgetownership CVE-2026-52933 kernel: netfilter: nat: use kfreercu to...

MiracleLinux 8 : kernel-4.18.0-553.157.1.el8_10 (AXSA:2026-1779:74)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1779:74 advisory. kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in ip6erspanchangeli...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053146)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053146 advisory. An out-of-bounds read vulnerability was found in smb2dumpdetail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the...

kernel: smb/client: fix out-of-bounds read in symlink_data()

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability arises from insufficient length validation in the smb2checkmessage function when processing symlink error responses. A remote attacker could exploit this by sending a specially crafted symlink error respons...