https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 18:37:05 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-98170 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()</p> <p>In move_smb2_ea_to_cifs(), the while (src_size &gt; 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds.</p> <p>Fix this by ensuring src_size &gt;= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer.</p> <p>Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating &#34;attribute not present&#34; or &#34;output buffer too small&#34;.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()</p> <p>In move_smb2_ea_to_cifs(), the while (src_size &gt; 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds.</p> <p>Fix this by ensuring src_size &gt;= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer.</p> <p>Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating &#34;attribute not present&#34; or &#34;output buffer too small&#34;.</p> https://db.gcve.eu/vuln/fkie_cve-2026-98170 https://db.gcve.eu/vuln/ghsa-qx7m-524h-7684 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()</p> <p>In move_smb2_ea_to_cifs(), the while (src_size &gt; 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds.</p> <p>Fix this by ensuring src_size &gt;= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer.</p> <p>Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating &#34;attribute not present&#34; or &#34;output buffer too small&#34;.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()</p> <p>In move_smb2_ea_to_cifs(), the while (src_size &gt; 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds.</p> <p>Fix this by ensuring src_size &gt;= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer.</p> <p>Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating &#34;attribute not present&#34; or &#34;output buffer too small&#34;.</p> https://db.gcve.eu/vuln/ghsa-qx7m-524h-7684 https://db.gcve.eu/vuln/msrc_cve-2026-98170 msrc_CVE-2026-98170 https://db.gcve.eu/vuln/msrc_cve-2026-98170 https://db.gcve.eu/vuln/opensuse-su-2026:12131-1 <p>kernel-devel-7.2.10-1.1 on GA media</p> <p>kernel-devel-7.2.10-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:12131-1 https://db.gcve.eu/vuln/ubuntu-cve-2026-98170 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:Pro:18.04:LTS: linux, Ubuntu:Pro:18.04:LTS: linux-aws, Ubuntu:18.04:LTS: linux-aws-5.0 and 240 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In move_smb2_ea_to_cifs(), the while (src_size &gt; 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds. Fix this by ensuring src_size &gt;= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer. Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating &#34;attribute not present&#34; or &#34;output buffer too small&#34;.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:Pro:18.04:LTS: linux, Ubuntu:Pro:18.04:LTS: linux-aws, Ubuntu:18.04:LTS: linux-aws-5.0 and 240 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In move_smb2_ea_to_cifs(), the while (src_size &gt; 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds. Fix this by ensuring src_size &gt;= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer. Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating &#34;attribute not present&#34; or &#34;output buffer too small&#34;.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-98170