ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

CVE-2026-98162

The Linux kernel contains a tree connection leak within the smb/server component, specifically in the smb2_tree_connect() function. The vulnerability occurs because if ksmbd_iov_pin_rsp() fails, the system returns a KSMBD_TREE_CONN_STATUS_NOMEM status without disconnecting the newly allocated tre...

EUVD-2026-87062

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2treeconnect See the procedure below: smb2treeconnect ksmbdtreeconnconnect xastore&sess-treeconns, treeconn-id, treeconn ksmbdcounterincKSMBDCOUNTERTREECONNS ksmbdsharetreeconnincsc...

CVE-2025-24071-POC

sudo apt update sudo apt install wine wine CVE-2025-24071-POC.exe -i 10.10.14.8 -n try ZIP creado: try.zip impacket-smbserver: smbserver.py try /root/smbshare -smb2support -ip 10.10.14.8 -debug Impacket Exegol fork v0.13.0.dev0+20250723.125503.b5db2dd7 - Copyright Fortra, LLC and its affiliated...

CVE-2020-0796

CVE-2020-0796 Windows SMBv3 Exploit de Elevación de Privilegios Locales Autores Daniel García Gutiérrez @danigargu Manuel Blanco Parajón @dialluvioso Referencias https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796...

Linux Distros Unpatched Vulnerability : CVE-2026-90164

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/server: abort initialization when proc setup fails ksmbdserverinit calls ksmbdprocinit before creating the remaining proc entries and server subsystems...

Linux Distros Unpatched Vulnerability : CVE-2026-90163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/server: call ksmbdproccleanup on module init failure When a later initializer fails, the unwind chain releases resources created after procfs and then jumps...

AZL-102218 CVE-2026-90166 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

DEBIAN-CVE-2026-90163

In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbdproccleanup on module init failure When a later initializer fails, the unwind chain releases resources created after procfs and then jumps directly to classunregister. Returning an error from moduleinit leav...

AZL-102138 CVE-2026-90165 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90175

CVE-2026-90175 is a memory leak in the Linux kernel's ksmbd SMB server module. The buffer returned by ksmbd_ipc_login_request_ext() is not freed unconditionally after ksmbd_alloc_user() calls, resulting in unreferenced 192-byte allocations triggered through the netlink/genl message path (specific...

CVE-2026-90175 smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbdipcloginrequestext returned buffer Free it unconditionally after ksmbdallocuser calls. kmemleak splat: unreferenced object 0xffff888103b83540 size 192: comm "pool-0", pid 16970, jiffies 4377290937 he...

CVE-2026-90165 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

CVE-2026-90166

CVE-2026-90166 affects the Linux kernel's SMB server (ksmbd) . The vulnerability is a null pointer dereference in ksmbd_ipc_tree_connect_request(), triggered when kstrdup() in ksmbd_share_config_get() fails and returns NULL for share->name, which is then passed to strlen() without a null check...

EUVD-2026-81759

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90166 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90152 smb/server: fix session leak in ksmbd_session_register()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix session leak in ksmbdsessionregister See the procedure below: smb2sesssetup ksmbdsmb2sessioncreate sessioncreate atomicset&sess-refcnt, 2 hashaddsessionstable, &sess-hlist, sess-id ksmbdsessionregister...

CVE-2026-90163: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbdproccleanup on module init failure When a later initializer fails, the unwind chain releases resources created after procfs and then jumps directly to classunregister. Returning an error from moduleinit leav...

CVE-2026-90166: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

CVE-2026-90152: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix session leak in ksmbdsessionregister See the procedure below: smb2sesssetup ksmbdsmb2sessioncreate sessioncreate atomicset&sess-refcnt, 2 hashaddsessionstable, &sess-hlist, sess-id ksmbdsessionregister...