https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 17:04:09 +0000 https://db.gcve.eu/vuln/cve-2026-98171 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs</p> <p>Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()&#39;s handling of compound encrypted frames:</p> <p>- Clear next_buffer after assigning it to server-&gt;bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd &lt; MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs</p> <p>Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()&#39;s handling of compound encrypted frames:</p> <p>- Clear next_buffer after assigning it to server-&gt;bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd &lt; MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.</p> https://db.gcve.eu/vuln/cve-2026-98171