CVE-2026-98162

A flaw was found in the Linux kernel's Server Message Block SMB file server ksmbd. A remote attacker could cause a Denial of Service DoS by sending tree connect requests that encounter an error during response processing. Because the server fails to properly clean up and release connection...

PT-2026-98845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A tree connection leak exists in the smb2 tree connect function. The issue occurs when the ksmbd iov pin rsp function fails, resulting in the failure to disconnect the new tree connectio...

PT-2026-94514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference occurs in the ksmbd ipc tree connect request function. This happens when ksmbd share config get fails during a kstrdup operation for share-name and the KSMBD...

PT-2026-93394

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the smb2 tree connect function within the ksmbd module. The ksmbd tree conn connect function publishes a new tree connection in sess-tree conns with a...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel, a high-performance in-kernel SMB server. The specific flaw occurs during the handling of the SMB2TREECONNECT and SMB2QUERYINFO commands. The issue arises from the lack of proper validation of a pointer before accessing it. An...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix for use-after-free in ksmbdtreeconnectput under concurrency conditions. Under high concurrency, a tree-connection object tcon is freed during a disconnection path, while another path still holds a reference to it...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in ksmbd within the Linux kernel versions 5.15 through 5.19, prior to 5.19.2. The file fs/ksmbd/smb2misc.c contains an out-of-bounds read and an OOPS error related to the SMB2TREECONNECT function...

Linux Distros Unpatched Vulnerability : CVE-2026-89631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two,...

CVE-2026-89631

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

DEBIAN-CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

AZL-100496 CVE-2026-89631 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

UBUNTU-CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631

CVE-2026-89631 affects the Linux kernel SMB (CIFS) client . In CIFSTCon(), the strnlen() bound over the byte area uses the server's ByteCount minus two; when ByteCount is 0 or 1, the value underflows to a huge size_t, causing cifs_strndup_from_utf16() to read up to 65,535 bytes past the ~16 KB sl...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

The vulnerabilities of the functions ksmbd_tree_conn_connect(), ksmbd_tree_connect PUT(), and ksmbd_tree_conn_disconnect() in the module fs/smb/server/mgmt/tree_connect.c, as well as the function smb2_tree_disconnect() in the module fs/smb/server/smb2pdu.c, allow attackers to compromise the confidentiality, integrity, and accessibility of protected information within the SMB server framework of the Linux operating system.

The vulnerabilities of the functions ksmbdtreeconnconnect, ksmbdtreeconnect PUT, and ksmbdtreeconndisconnect in the module fs/smb/server/mgmt/treeconnect.c, as well as the function smb2treedisconnect in the module fs/smb/server/smb2pdu.c, are related to the reuse of previously freed memory due to...

SUSE CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

CVE-2026-64136 smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tccount increment in smb2findsmbsesstconunlocked Commit 96c4af418586 "cifs: Fix locking usage for tcon fields" refactored cifs code to change cifstcpseslock for tclock around tccount changes. There was missin...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...