CVE-2026-98170

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

UBUNTU-CVE-2026-98175

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98175

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

UBUNTU-CVE-2026-98174

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

UBUNTU-CVE-2026-98171

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

UBUNTU-CVE-2026-98167

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...

CVE-2026-98171

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

CVE-2026-98318

The Linux kernel contains a vulnerability in the smb client where absolute native symlink targets are not properly validated before NT fixups when symlinkroot is unset. Because the code incorrectly assumes an NT prefix is present, providing a target like "/ab" causes out-of-bounds writes to the s...

CVE-2026-98318 smb: client: validate absolute native symlink targets before NT fixups

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98175 smb: client: cancel reconnect work in clean_demultiplex_info()

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98175

The Linux kernel contains a use-after-free vulnerability in the SMB client component. The root cause is that the clean_demultiplex_info() function fails to cancel the server->reconnect delayed work, while it does cancel server->echo. This allows a use-after-free to occur when the demultiple...

CVE-2026-98174 smb: client: fix rlist race and missing initialization

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

CVE-2026-98174

The Linux kernel contains a vulnerability in the smb client due to a race condition and missing initialization. Specifically, TCP_Server_Info.rlist is allocated via kzalloc, which incorrectly sets ->next and ->prev to NULL instead of pointing to the node itself; this causes list_empty() to ...

CVE-2026-98174 smb: client: fix rlist race and missing initialization

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

EUVD-2026-93102

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

CVE-2026-98173

The Linux kernel contains a use-after-free vulnerability in the SMB client component within the cifs_try_adding_channels() function. The issue arises because the function captures the next entry (niface) under iface_lock but then drops the lock for the duration of cifs_ses_add_channel(). A concur...

CVE-2026-98173 smb: client: fix use-after-free of iface in cifs_try_adding_channels()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98173

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98173 smb: client: fix use-after-free of iface in cifs_try_adding_channels()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98172

The Linux kernel contains a vulnerability in the SMB client where an smbd_connection leak occurs. When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() subsequently fails (for example, if kthread_create() returns an error), the error path incorre...