Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-27 19:44Z
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64400 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64400

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using parent-directory components ('..'), vfs_path_parent_lookup() detects this and immediately fails, returning -EXDEV. However, a bug exists in __ksmbd_vfs_kern_path() under caseless CVSSv3.1 8.6 (HIGH) · EPSS 17th percentile

TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64399 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64399

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the destination file's data via vfs_clone_file_range() with neither the share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle fp->daccess check that the other write-bearing arms carry. A client can overwrite destination data on a read-only share, or from a handle ope CVSSv3.1 9.8 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64398 — Linux: This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES still yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of FILE_WRITE_DESIRE_AC CVSSv3.1 8.1 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64397 — Linux: Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free. Add a per-file mutex and hold it while accessing the shared directory enumerat CVSSv3.1 9.8 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64396 — Linux: This leads to a slab-use-after-free inside __wake_up_common.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64396

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into the connection's async_requests list via setup_async_work(). The cancel callback smb2_remove_blocked_lock() holds a reference to the flock. If the lock waiter is subsequently woken up but the work state is n CVSSv3.1 8.8 (HIGH) · EPSS 12th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64394 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to fsctl_set_sparse and noted that "similar handle-level checks exist in other functions but are missing here." The SMB2 SET_INFO SECURITY arm is one of the missing ones, and the most security-relevant: smb2_s CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64393 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64393

In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the current ksmbd worker credentials. Run the complete SET_INFO dispatch with the credentials captured when the handle was opened. This also removes the separate security information CVSSv3.1 9.1 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64392 — Linux: Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64392

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks. Run both operations with the credentials captured in struct file when the handle was opened. This pres CVSSv3.1 9.1 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64391 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64391

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the current task credentials. Run ADS I/O with the credentials captured when the SMB handle was opened. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64390 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock. With SMB3 multichannel, the connection handling the LOCK request can be different from the connection CVSSv3.1 8.8 (HIGH) · EPSS 12th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64389 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives the NTLMv2 session key into sess->sess_key before it verifies the NTLMv2 response. ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even when ksmbd_auth_ntlmv2() failed. With SMB3 multichannel binding, the failed authentication operates on an existing session and the session setup error path does not expire CVSSv3.1 8.2 (HIGH) · EPSS 16th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64387 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64387

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64386 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64386

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64385 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64385

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64384 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64384

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64383 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64383

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifs_send_recv() stores a replacement response, flush_exit will free the stale response pointer a second time. Reinitialize resp_buftype and rsp_iov at the top of the replay loop so cleanup only acts on resp CVSSv3.1 9.8 (CRITICAL) · EPSS 11th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64382 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64382

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64380 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64380

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely. CVSSv3.1 8.2 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64368 — Linux: However the current check is imprecise, and will trigger also when only SLAB_RED_ZONE is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64368

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if a smaller size is requested, in order to provide krealloc()'s __GFP_ZERO guarantees. But if we track the requested size, krealloc() uses that information to do the right thing, so we can zero only the requested size. CVSSv3.1 8.1 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64366 — Linux: In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64366

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifo_skip() reads stale data left in the kmalloc'd buffer via __kfifo_peek_n() and interprets it as a record length, advancing fifo->out by that garbage value. This corrupts the internal kfifo state, CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64364 — Linux: In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64364

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexed by the slot number. That slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report and can be up to 255, not by BITS_PER_LONG. As a result, CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64355 — Linux: Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but without valid frag metadata, and the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64355

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, while fragmented frames keep skb_shared_info in tailroom outside the linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but without valid frag metadata, and the later free path can interpret uninitialized t CVSSv3.1 9.8 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64320 — Linux: In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64320

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-bit offset is then added to a small kzalloc'd buffer that holds the discovery log page and the result is passed straight to nvmet_copy_to_sgl(), which memcpy()s data_len bytes out to the host with no source-side bound c CVSSv3.1 9.1 (CRITICAL) · EPSS 17th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64319 — Linux: A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a small transfer length

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying they fit within the allocated buffer of tl bytes. A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a small transfer length but large hl/dhvlen values, causing CVSSv3.1 9.1 (CRITICAL) · EPSS 17th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64313 — Linux: In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64313

In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows. The condition (r01.m_high < product.m_high) doesn't handle the case where r01.m_high == product.m_high and an additional carry exists from lower-bit overflow. When commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support") int CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score