CVE-2026-64437 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on SMB2CLOSE then SMB2CANCEL Commit f580d27e8928 "ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL" made smb2cancel skip a work whose state is...

CVE-2026-64437 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on SMB2CLOSE then SMB2CANCEL Commit f580d27e8928 "ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL" made smb2cancel skip a work whose state is...

CVE-2026-64437

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on SMB2CLOSE then SMB2CANCEL Commit f580d27e8928 "ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL" made smb2cancel skip a work whose state is...

CVE-2026-64402

CVE-2026-64402 concerns the Linux kernel coresight ultrasoc-smb path: an OOB write in smb_sync_perf_buffer() can occur when the SMB sink is used as a perf AUX sink because the initial page index is derived before applying modulo normalization to the buffer size. The issue is fixed by normalizing ...

CVE-2026-64402

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smbsyncperfbuffer When the SMB sink is used as a perf AUX sink, smbupdatebuffer calls smbsyncperfbuffer to copy hardware trace data into the perf AUX ring buffer pages. It derives pgidx =...

CVE-2026-64402 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smbsyncperfbuffer When the SMB sink is used as a perf AUX sink, smbupdatebuffer calls smbsyncperfbuffer to copy hardware trace data into the perf AUX ring buffer pages. It derives pgidx =...

EUVD-2026-48946

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smbsyncperfbuffer When the SMB sink is used as a perf AUX sink, smbupdatebuffer calls smbsyncperfbuffer to copy hardware trace data into the perf AUX ring buffer pages. It derives pgidx =...

CVE-2026-64401 smb: client: resolve SWN tcon from live registrations

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifsswnnotify looks up a witness registration by id under cifsswnregidrmutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a...

CVE-2026-64400

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbdvfspathlookup enforces LOOKUPBENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using...

CVE-2026-64399 ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via vfsclonefilerange with neither the share-level KSMBDTREECONNFLAGWRITABLE che...

EUVD-2026-48941

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

CVE-2026-64395

Summary: CVE-2026-64395 in the Linux kernel ksmbd exposes information disclosure via FSCTL_DUPLICATE_EXTENTS_TO_FILE. The source file is passed directly to vfs_clone_file_range() / vfs_copy_file_range() without checking the SMB access mask, enabling a handle opened with attribute access to copy c...

CVE-2026-64395

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

CVE-2026-64396 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...

CVE-2026-64392 ksmbd: use opener credentials for delete-on-close

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run...

CVE-2026-64392

The CVE-2026-64392 entry concerns the Linux kernel ksmbd delete-on-close path. The underlying issue was that delete-on-close could execute unlink and ADS xattr removal with ksmbd worker credentials rather than the credentials captured at file open, allowing potential permission checks bypass. The...

CVE-2026-64392

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run...

CVE-2026-64389 ksmbd: validate NTLMv2 response before updating session key

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

CVE-2026-64388

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

EUVD-2026-48933

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...