Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0982
Vulnerability from certfr_avis - Published: 2026-08-07 - Updated: 2026-08-07
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 5.10.262-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
},
{
"description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.1.180-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64376"
},
{
"name": "CVE-2026-53398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53398"
},
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-64275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64275"
},
{
"name": "CVE-2026-64274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64274"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64452"
},
{
"name": "CVE-2026-64483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64483"
},
{
"name": "CVE-2026-64322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64322"
},
{
"name": "CVE-2026-64470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64470"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64512"
},
{
"name": "CVE-2026-64409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64409"
},
{
"name": "CVE-2026-64380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64380"
},
{
"name": "CVE-2026-64268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64268"
},
{
"name": "CVE-2026-64489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64489"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64480"
},
{
"name": "CVE-2026-64399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64399"
},
{
"name": "CVE-2026-63818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
},
{
"name": "CVE-2026-64454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64454"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
},
{
"name": "CVE-2026-53400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53400"
},
{
"name": "CVE-2026-64365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64365"
},
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2026-63830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63830"
},
{
"name": "CVE-2026-64333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64333"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-64514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64514"
},
{
"name": "CVE-2026-64279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64279"
},
{
"name": "CVE-2026-64337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64337"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64430"
},
{
"name": "CVE-2026-64497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64497"
},
{
"name": "CVE-2026-64189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
},
{
"name": "CVE-2026-63798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63798"
},
{
"name": "CVE-2026-63810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63810"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-64304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64304"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-53397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
},
{
"name": "CVE-2026-64252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64252"
},
{
"name": "CVE-2026-64276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64276"
},
{
"name": "CVE-2026-64475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64475"
},
{
"name": "CVE-2026-64323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64323"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64271"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64455"
},
{
"name": "CVE-2026-52942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52942"
},
{
"name": "CVE-2026-46331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46331"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-64445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64445"
},
{
"name": "CVE-2026-64500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64500"
},
{
"name": "CVE-2026-63806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63806"
},
{
"name": "CVE-2026-64330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64330"
},
{
"name": "CVE-2026-64348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64348"
},
{
"name": "CVE-2026-64469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64469"
},
{
"name": "CVE-2026-64362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64362"
},
{
"name": "CVE-2026-63800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
},
{
"name": "CVE-2026-64486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64486"
},
{
"name": "CVE-2026-64446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64446"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64338"
},
{
"name": "CVE-2026-46116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46116"
},
{
"name": "CVE-2026-64249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64249"
},
{
"name": "CVE-2026-64536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64536"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-53402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
},
{
"name": "CVE-2026-64351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64351"
},
{
"name": "CVE-2026-23204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23204"
},
{
"name": "CVE-2026-63835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63835"
},
{
"name": "CVE-2026-64432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64432"
},
{
"name": "CVE-2026-63796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63796"
},
{
"name": "CVE-2026-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43499"
},
{
"name": "CVE-2026-53332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53332"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64296"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64370"
},
{
"name": "CVE-2026-43216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43216"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-64299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64299"
},
{
"name": "CVE-2026-64374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64374"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64345"
},
{
"name": "CVE-2026-53329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53329"
},
{
"name": "CVE-2026-53382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53382"
},
{
"name": "CVE-2026-64504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64504"
},
{
"name": "CVE-2026-64398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64398"
},
{
"name": "CVE-2026-64297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64297"
},
{
"name": "CVE-2026-64343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64343"
},
{
"name": "CVE-2026-64397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64397"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64471"
},
{
"name": "CVE-2026-64468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64468"
},
{
"name": "CVE-2026-64449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64449"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-63797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63797"
},
{
"name": "CVE-2026-64456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64456"
},
{
"name": "CVE-2026-64306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64306"
},
{
"name": "CVE-2026-64465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64465"
},
{
"name": "CVE-2026-64313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64313"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-64442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64442"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64248"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-53392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64332"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-64458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64458"
},
{
"name": "CVE-2026-64476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64476"
},
{
"name": "CVE-2026-64378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64378"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-64318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64318"
},
{
"name": "CVE-2026-63794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63794"
},
{
"name": "CVE-2026-64394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64394"
},
{
"name": "CVE-2026-53177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53177"
},
{
"name": "CVE-2026-63824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63824"
},
{
"name": "CVE-2026-64435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64435"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64336"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64346"
},
{
"name": "CVE-2026-31610",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31610"
},
{
"name": "CVE-2026-63822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63822"
},
{
"name": "CVE-2026-64187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64187"
},
{
"name": "CVE-2026-64342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64342"
},
{
"name": "CVE-2026-64360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64360"
},
{
"name": "CVE-2022-50114",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50114"
},
{
"name": "CVE-2026-64478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64478"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64437"
},
{
"name": "CVE-2026-64335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64335"
},
{
"name": "CVE-2026-64301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64301"
},
{
"name": "CVE-2026-64315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64315"
},
{
"name": "CVE-2026-64395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64395"
},
{
"name": "CVE-2026-64273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64273"
},
{
"name": "CVE-2026-63828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63828"
},
{
"name": "CVE-2024-36013",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36013"
},
{
"name": "CVE-2025-40196",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40196"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-46135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46135"
},
{
"name": "CVE-2026-64529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64529"
},
{
"name": "CVE-2026-64381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64381"
},
{
"name": "CVE-2026-53393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53393"
},
{
"name": "CVE-2026-64496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64496"
},
{
"name": "CVE-2026-64408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64408"
},
{
"name": "CVE-2026-64316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64316"
},
{
"name": "CVE-2026-64417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64417"
},
{
"name": "CVE-2026-64423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64423"
},
{
"name": "CVE-2026-64443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64443"
},
{
"name": "CVE-2026-53159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53159"
},
{
"name": "CVE-2026-64269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64269"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64482"
},
{
"name": "CVE-2026-64495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64495"
},
{
"name": "CVE-2026-64396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64396"
},
{
"name": "CVE-2026-64324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64324"
},
{
"name": "CVE-2026-64329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64329"
},
{
"name": "CVE-2026-64373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64373"
},
{
"name": "CVE-2026-64277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64277"
},
{
"name": "CVE-2026-64503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64503"
},
{
"name": "CVE-2026-31755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31755"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-63809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63809"
},
{
"name": "CVE-2026-64436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64436"
},
{
"name": "CVE-2026-64403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64403"
},
{
"name": "CVE-2026-63836",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63836"
},
{
"name": "CVE-2026-63814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63814"
},
{
"name": "CVE-2026-64412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64412"
},
{
"name": "CVE-2026-64188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64188"
},
{
"name": "CVE-2026-64487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64487"
},
{
"name": "CVE-2026-64303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64303"
},
{
"name": "CVE-2026-64429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64429"
},
{
"name": "CVE-2026-64344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64344"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-63834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63834"
},
{
"name": "CVE-2026-64350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64350"
},
{
"name": "CVE-2026-64250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64250"
},
{
"name": "CVE-2026-64411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64411"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64334"
},
{
"name": "CVE-2026-64448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64448"
},
{
"name": "CVE-2026-64347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64347"
},
{
"name": "CVE-2025-39931",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39931"
},
{
"name": "CVE-2026-64393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64393"
},
{
"name": "CVE-2026-64419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64419"
},
{
"name": "CVE-2026-64372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64372"
},
{
"name": "CVE-2026-64444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64444"
},
{
"name": "CVE-2022-49803",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-49803"
},
{
"name": "CVE-2026-64331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64331"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64494"
},
{
"name": "CVE-2026-53385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53385"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-63808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63808"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64379"
},
{
"name": "CVE-2026-64420",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64420"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64406"
},
{
"name": "CVE-2026-64425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64425"
},
{
"name": "CVE-2026-64600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64600"
},
{
"name": "CVE-2026-64312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64312"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64505"
},
{
"name": "CVE-2026-64355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64355"
},
{
"name": "CVE-2026-64422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64422"
},
{
"name": "CVE-2026-64340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64340"
},
{
"name": "CVE-2026-64450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64450"
},
{
"name": "CVE-2026-64484",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64484"
},
{
"name": "CVE-2026-64298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64298"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2023-52494",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52494"
},
{
"name": "CVE-2026-64266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64266"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
},
{
"name": "CVE-2026-63829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63829"
},
{
"name": "CVE-2026-64440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64440"
},
{
"name": "CVE-2026-63803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63803"
},
{
"name": "CVE-2026-64359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64359"
},
{
"name": "CVE-2026-43219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43219"
},
{
"name": "CVE-2026-64317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64317"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0982",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00007",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00007.html"
},
{
"published_at": "2026-08-05",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00008",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00008.html"
}
]
}
CVE-2026-64390 (GCVE-0-2026-64390)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
ksmbd: track the connection owning a byte-range lock
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: track the connection owning a byte-range lock
SMB2_LOCK adds each granted byte-range lock to both the file lock list
and the lock list of the connection which handled the request. The
final close and durable handle paths, however, remove the connection
list entry while holding fp->conn->llist_lock.
With SMB3 multichannel, the connection handling the LOCK request can be
different from the connection which opened the file. The entry can
therefore be removed under a different spinlock from the one protecting
the list it belongs to. A concurrent traversal can then access freed
struct ksmbd_lock and struct file_lock objects.
Record the connection owning each lock's clist entry and hold a
reference to it while the entry is linked. Use that connection and its
llist_lock for unlock, rollback, close, and durable preserve. Durable
reconnect assigns the new connection as the owner when publishing the
locks again.
Severity
8.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
f5a544e3bab78142207e0242d22442db85ba1eff , < 22d38cf75b556c20b039743bdf3654d535b858be
(git)
Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 66eb3643164e5e1029907793926c132f8b5c6148 (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < ea5c9bf99f626a15cc59f645dc895f2b3f01992e (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < fe20d492a69a6f79e637f438072b212e21ed3b78 (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 427faaa52b0b399940c1a88065a5c310d10dad15 (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 5fecc15a30cb9ebd310f7b52c1ab607edcea78f6 (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/vfs_cache.c",
"fs/smb/server/vfs_cache.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22d38cf75b556c20b039743bdf3654d535b858be",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "66eb3643164e5e1029907793926c132f8b5c6148",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "ea5c9bf99f626a15cc59f645dc895f2b3f01992e",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "fe20d492a69a6f79e637f438072b212e21ed3b78",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "427faaa52b0b399940c1a88065a5c310d10dad15",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "5fecc15a30cb9ebd310f7b52c1ab607edcea78f6",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/vfs_cache.c",
"fs/smb/server/vfs_cache.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: track the connection owning a byte-range lock\n\nSMB2_LOCK adds each granted byte-range lock to both the file lock list\nand the lock list of the connection which handled the request. The\nfinal close and durable handle paths, however, remove the connection\nlist entry while holding fp-\u003econn-\u003ellist_lock.\n\nWith SMB3 multichannel, the connection handling the LOCK request can be\ndifferent from the connection which opened the file. The entry can\ntherefore be removed under a different spinlock from the one protecting\nthe list it belongs to. A concurrent traversal can then access freed\nstruct ksmbd_lock and struct file_lock objects.\n\nRecord the connection owning each lock\u0027s clist entry and hold a\nreference to it while the entry is linked. Use that connection and its\nllist_lock for unlock, rollback, close, and durable preserve. Durable\nreconnect assigns the new connection as the owner when publishing the\nlocks again."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An attacker reaches smb2_lock through remotely supplied SMB2 requests handled by ksmbd over TCP port 445.\nAC:L - In a multichannel deployment, the attacker controls the channels, lock creation, concurrent traversal, connection teardown, and close operations needed to trigger the lifetime violation.\nPR:L - The path requires a valid non-guest SMB3 session, signed multichannel binding, authorized tree connection, and an accessible file handle. An ordinary authenticated share user suffices; no administrative privilege is required.\nUI:N - The authenticated attacker can open, lock, traverse, and close the file or disconnect a channel without any victim action.\nS:U - The memory corruption compromises the ksmbd host kernel within the same security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - Freed ksmbd_lock and file_lock objects can be reclaimed and subsequently dereferenced during connection lock-list traversal, supporting disclosure of arbitrary kernel memory during exploitation.\nI:H - Stale list_del operations write through freed or attacker-influenced list pointers, providing exploitable heap corruption that can plausibly yield arbitrary writes and kernel code execution.\nA:H - The use-after-free and corrupted linked lists can cause kernel oopses, panics, or hangs, and the remote attacker can repeatedly retrigger the condition."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:27.278Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22d38cf75b556c20b039743bdf3654d535b858be"
},
{
"url": "https://git.kernel.org/stable/c/66eb3643164e5e1029907793926c132f8b5c6148"
},
{
"url": "https://git.kernel.org/stable/c/ea5c9bf99f626a15cc59f645dc895f2b3f01992e"
},
{
"url": "https://git.kernel.org/stable/c/fe20d492a69a6f79e637f438072b212e21ed3b78"
},
{
"url": "https://git.kernel.org/stable/c/427faaa52b0b399940c1a88065a5c310d10dad15"
},
{
"url": "https://git.kernel.org/stable/c/5fecc15a30cb9ebd310f7b52c1ab607edcea78f6"
},
{
"url": "https://git.kernel.org/stable/c/c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb"
}
],
"title": "ksmbd: track the connection owning a byte-range lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64390",
"datePublished": "2026-07-25T08:50:37.406Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:27.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64393 (GCVE-0-2026-64393)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
ksmbd: run set info with opener credentials
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: run set info with opener credentials
SMB2 SET_INFO handlers call path-based VFS helpers after checking the
access mask granted to the SMB handle. Those helpers perform their owner,
inode permission and LSM checks using the current ksmbd worker credentials.
Run the complete SET_INFO dispatch with the credentials captured when the
handle was opened. This also removes the separate security information
credential setup and keeps all SET_INFO classes under one credential scope.
Direct override_creds() is used because it can nest with the request
credential overrides already used by rename and link helpers.
Severity
9.1 (Critical)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 5cbabf3a71575cd31bc7785d92d4ab42338a654b
(git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < b35afd5cf8fab236ef21117e42ee45691d4ffa7b (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 0ce682867fd506f61f40c76bde7e4205bde34e87 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 20ee516a62989a8d505ee432f9e59525ea23984e (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 8cc9ec711f5255167247a9ab6a7179b787426ed7 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < b383bcad3d2fe634b26efbce53e22bbb5753a520 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5cbabf3a71575cd31bc7785d92d4ab42338a654b",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "b35afd5cf8fab236ef21117e42ee45691d4ffa7b",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "0ce682867fd506f61f40c76bde7e4205bde34e87",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "20ee516a62989a8d505ee432f9e59525ea23984e",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "8cc9ec711f5255167247a9ab6a7179b787426ed7",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "b383bcad3d2fe634b26efbce53e22bbb5753a520",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: run set info with opener credentials\n\nSMB2 SET_INFO handlers call path-based VFS helpers after checking the\naccess mask granted to the SMB handle. Those helpers perform their owner,\ninode permission and LSM checks using the current ksmbd worker credentials.\n\nRun the complete SET_INFO dispatch with the credentials captured when the\nhandle was opened. This also removes the separate security information\ncredential setup and keeps all SET_INFO classes under one credential scope.\n\nDirect override_creds() is used because it can nest with the request\ncredential overrides already used by rename and link helpers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SMB2 SET_INFO handler is remotely reachable through ksmbd over TCP/445 or SMB Direct.\nAC:L - An attacker can deterministically open a handle and send a crafted SET_INFO request; no race or condition outside the attacker\u2019s control is required.\nPR:N - Although a valid SMB session, writable tree, and suitable handle are required, ksmbd supports passwordless guest sessions on writable shares, making exploitation possible without attacker privileges in a reasonable deployment.\nUI:N - The attacker directly opens the handle and submits the SET_INFO request without any victim action.\nS:U - The bypass affects files and services governed by the same host kernel and filesystem security authority, without crossing a virtualization or sandbox boundary.\nC:N - The flaw provides unauthorized mutation through metadata, xattr, and truncation operations but does not itself disclose file contents or kernel memory.\nI:H - Privileged worker credentials can bypass opener UID, group, capability, inode, and LSM checks, permitting protected metadata changes and destructive truncation of an affected file.\nA:H - Repeated SET_INFO requests can truncate critical files or corrupt security-relevant metadata and xattrs, potentially disabling dependent services or exhausting filesystem resources."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:30.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5cbabf3a71575cd31bc7785d92d4ab42338a654b"
},
{
"url": "https://git.kernel.org/stable/c/b35afd5cf8fab236ef21117e42ee45691d4ffa7b"
},
{
"url": "https://git.kernel.org/stable/c/0ce682867fd506f61f40c76bde7e4205bde34e87"
},
{
"url": "https://git.kernel.org/stable/c/20ee516a62989a8d505ee432f9e59525ea23984e"
},
{
"url": "https://git.kernel.org/stable/c/8cc9ec711f5255167247a9ab6a7179b787426ed7"
},
{
"url": "https://git.kernel.org/stable/c/b383bcad3d2fe634b26efbce53e22bbb5753a520"
}
],
"title": "ksmbd: run set info with opener credentials",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64393",
"datePublished": "2026-07-25T08:50:39.239Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:30.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64394 (GCVE-0-2026-64394)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a
permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to
fsctl_set_sparse and noted that "similar handle-level checks exist in other
functions but are missing here." The SMB2 SET_INFO SECURITY arm is one of
the missing ones, and the most security-relevant: smb2_set_info_sec() calls
set_info_sec() with no per-handle access check.
set_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it
rewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via
set_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and
rewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().
Every other persistent-mutation arm of the sibling handler
smb2_set_info_file() checks fp->daccess first (FILE_WRITE_DATA /
FILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm —
which mutates the access control itself — is the only one with no gate.
A client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no
FILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType
SMB2_O_INFO_SECURITY to rewrite the file's DACL and owner, granting itself
access the handle's daccess never carried. Unlike the FSCTL data arms this
is a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop —
the missing fp->daccess check is the entire gate.
Setting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so
require at least one of those on the handle before re-permissioning the
file. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info().
Severity
8.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 0848b1d8b403f530878195dcbe241a2fddb9d0e1
(git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < e6aa731f1b4b3e08caebf66a99f04b22bdab2e99 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 9ab2ffd3ed3d4ca1667c52de27026ddabc11e537 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < f56535db508ead8dec1c481ad93d7d8acd8f8f1e (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < aae600cdaffc6d9ce97645f129799a103a97d06d (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 44df157a1183a7f746caa970c169255da5ac61f8 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0848b1d8b403f530878195dcbe241a2fddb9d0e1",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "e6aa731f1b4b3e08caebf66a99f04b22bdab2e99",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "9ab2ffd3ed3d4ca1667c52de27026ddabc11e537",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "f56535db508ead8dec1c481ad93d7d8acd8f8f1e",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "aae600cdaffc6d9ce97645f129799a103a97d06d",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "44df157a1183a7f746caa970c169255da5ac61f8",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY\n\ncommit cc57232cae23 (\"ksmbd: fix FSCTL permission bypass by adding a\npermission check for FSCTL_SET_SPARSE\") added a fp-\u003edaccess gate to\nfsctl_set_sparse and noted that \"similar handle-level checks exist in other\nfunctions but are missing here.\" The SMB2 SET_INFO SECURITY arm is one of\nthe missing ones, and the most security-relevant: smb2_set_info_sec() calls\nset_info_sec() with no per-handle access check.\n\nset_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it\nrewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via\nset_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and\nrewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().\nEvery other persistent-mutation arm of the sibling handler\nsmb2_set_info_file() checks fp-\u003edaccess first (FILE_WRITE_DATA /\nFILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm \u2014\nwhich mutates the access control itself \u2014 is the only one with no gate.\n\nA client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no\nFILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType\nSMB2_O_INFO_SECURITY to rewrite the file\u0027s DACL and owner, granting itself\naccess the handle\u0027s daccess never carried. Unlike the FSCTL data arms this\nis a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop \u2014\nthe missing fp-\u003edaccess check is the entire gate.\n\nSetting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so\nrequire at least one of those on the handle before re-permissioning the\nfile. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SMB2 SET_INFO handler is remotely reachable through ksmbd over TCP port 445.\nAC:L - An attacker can deterministically open an attribute-only handle and submit a crafted security descriptor, with no race or uncontrollable condition.\nPR:L - A valid SMB session, writable tree connection, and permission to open the target with FILE_WRITE_ATTRIBUTES are required, but no administrative privileges are needed.\nUI:N - The attacker directly sends the SMB requests without requiring any victim action.\nS:U - The bypass affects files governed by the same host and ksmbd share security authority and does not cross a virtualization or sandbox boundary.\nC:H - The attacker can rewrite the DACL and mode to grant read access, potentially disclosing complete protected files within the share.\nI:H - The attacker can grant itself write or delete rights and subsequently modify or destroy protected file contents, ownership metadata, and ACLs.\nA:H - The attacker can deny legitimate access or grant itself sufficient rights to corrupt or destroy affected share data, causing complete loss of availability for those resources."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:31.580Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0848b1d8b403f530878195dcbe241a2fddb9d0e1"
},
{
"url": "https://git.kernel.org/stable/c/e6aa731f1b4b3e08caebf66a99f04b22bdab2e99"
},
{
"url": "https://git.kernel.org/stable/c/9ab2ffd3ed3d4ca1667c52de27026ddabc11e537"
},
{
"url": "https://git.kernel.org/stable/c/f56535db508ead8dec1c481ad93d7d8acd8f8f1e"
},
{
"url": "https://git.kernel.org/stable/c/aae600cdaffc6d9ce97645f129799a103a97d06d"
},
{
"url": "https://git.kernel.org/stable/c/44df157a1183a7f746caa970c169255da5ac61f8"
}
],
"title": "ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64394",
"datePublished": "2026-07-25T08:50:39.797Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:31.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64395 (GCVE-0-2026-64395)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
ksmbd: require source read access for duplicate extents
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: require source read access for duplicate extents
FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to
vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB
access mask granted to the source handle. A handle opened with attribute
access can consequently be used to copy file contents into an
attacker-readable destination.
Require FILE_READ_DATA on the source handle before either VFS operation,
matching other ksmbd data-copy paths.
Severity
7.5 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eb817368f50c1cbe1bd07044124aad7db6330e3a , < 2d2ab6983620c2d60ce7db72133984ca3873b929
(git)
Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < 67bdad9cf01b25030e3bf00bbce6c309319d6663 (git) Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f (git) Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < db231af842868268839f9f9619c68cb27830d8be (git) Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < a10942af27832c2761d020863a46e79bebe0567d (git) Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < cedff600f1642aa982178503552f0d007bc829c8 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2d2ab6983620c2d60ce7db72133984ca3873b929",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "67bdad9cf01b25030e3bf00bbce6c309319d6663",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "db231af842868268839f9f9619c68cb27830d8be",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "a10942af27832c2761d020863a46e79bebe0567d",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "cedff600f1642aa982178503552f0d007bc829c8",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require source read access for duplicate extents\n\nFSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to\nvfs_clone_file_range() or vfs_copy_file_range() without checking the SMB\naccess mask granted to the source handle. A handle opened with attribute\naccess can consequently be used to copy file contents into an\nattacker-readable destination.\n\nRequire FILE_READ_DATA on the source handle before either VFS operation,\nmatching other ksmbd data-copy paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SMB2 IOCTL is remotely reachable through ksmbd over TCP, normally port 445.\nAC:L - The attacker controls both handles, offsets, and copy length; no race is required, and exploitation is reliable on common reflink-capable filesystems such as XFS and Btrfs.\nPR:N - In a reasonable guest-enabled writable-share deployment, an unauthenticated remote attacker can establish a guest session without credentials and obtain the required attribute-only source and writable destination handles.\nUI:N - After connecting to the share, the attacker can open both handles and issue the IOCTL without any victim action.\nS:U - The bypass discloses files governed by the same kernel and SMB server security authority and does not cross a virtualization or other security scope.\nC:H - Attacker-controlled offsets and lengths allow complete copying of otherwise unreadable files into an attacker-readable destination, causing total confidentiality loss for protected share contents.\nI:N - The source is not modified, and the destination must already be on a writable tree and opened with FILE_WRITE_DATA, so the flaw adds no unauthorized modification capability.\nA:N - The operation does not corrupt memory, crash the kernel, or inherently disrupt service; any destination writes are already authorized by the required handle permissions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:32.736Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2d2ab6983620c2d60ce7db72133984ca3873b929"
},
{
"url": "https://git.kernel.org/stable/c/67bdad9cf01b25030e3bf00bbce6c309319d6663"
},
{
"url": "https://git.kernel.org/stable/c/b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f"
},
{
"url": "https://git.kernel.org/stable/c/db231af842868268839f9f9619c68cb27830d8be"
},
{
"url": "https://git.kernel.org/stable/c/a10942af27832c2761d020863a46e79bebe0567d"
},
{
"url": "https://git.kernel.org/stable/c/cedff600f1642aa982178503552f0d007bc829c8"
}
],
"title": "ksmbd: require source read access for duplicate extents",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64395",
"datePublished": "2026-07-25T08:50:40.393Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:32.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64396 (GCVE-0-2026-64396)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
When a blocking byte-range lock request is deferred in the
FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into
the connection's async_requests list via setup_async_work(). The cancel
callback smb2_remove_blocked_lock() holds a reference to the flock.
If the lock waiter is subsequently woken up but the work state is no
longer KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the
cleanup path calls locks_free_lock(flock) without dequeuing the work from
the async_requests list. Concurrently, smb2_cancel() walks the list
under conn->request_lock and invokes the cancel callback, which then
dereferences the already freed 'flock'. This leads to a slab-use-after-free
inside __wake_up_common.
Fix this by restructuring the cleanup logic after the worker returns
from ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock->llist) and
release_async_work(work) to the top of the cleanup block. This guarantees
that the async work is completely dequeued and serialized under
conn->request_lock before locks_free_lock(flock) is called, rendering
the flock unreachable for any concurrent smb2_cancel().
Severity
8.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 367c42a611fe488b7b03f1f6737f4dee0e8b20a2
(git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 7703fd9aba1f2483c8e55f9ff73b7663e0761ed9 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 463bbd79698513af4dad50fe1c573825f297ca2e (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 5aa1cb01155f96824003baf7997cdf1f150caba3 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 5c75275c0fc9a2deb0d8f5604edcb16f288171c8 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "367c42a611fe488b7b03f1f6737f4dee0e8b20a2",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "7703fd9aba1f2483c8e55f9ff73b7663e0761ed9",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "463bbd79698513af4dad50fe1c573825f297ca2e",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "5aa1cb01155f96824003baf7997cdf1f150caba3",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "5c75275c0fc9a2deb0d8f5604edcb16f288171c8",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation\n\nWhen a blocking byte-range lock request is deferred in the\nFILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into\nthe connection\u0027s async_requests list via setup_async_work(). The cancel\ncallback smb2_remove_blocked_lock() holds a reference to the flock.\n\nIf the lock waiter is subsequently woken up but the work state is no\nlonger KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the\ncleanup path calls locks_free_lock(flock) without dequeuing the work from\nthe async_requests list. Concurrently, smb2_cancel() walks the list\nunder conn-\u003erequest_lock and invokes the cancel callback, which then\ndereferences the already freed \u0027flock\u0027. This leads to a slab-use-after-free\ninside __wake_up_common.\n\nFix this by restructuring the cleanup logic after the worker returns\nfrom ksmbd_vfs_posix_lock_wait(). Move list_del(\u0026smb_lock-\u003ellist) and\nrelease_async_work(work) to the top of the cleanup block. This guarantees\nthat the async work is completely dequeued and serialized under\nconn-\u003erequest_lock before locks_free_lock(flock) is called, rendering\nthe flock unreachable for any concurrent smb2_cancel()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ksmbd accepts remote SMB traffic over TCP port 445, and SMB2 LOCK, CLOSE, and CANCEL requests reach the vulnerable code through the network handler.\nAC:L - The attacker can create both conflicting file handles, obtain the deferred request\u0027s AsyncId, and control the CLOSE/CANCEL sequencing, so both sides of the race are attacker-controlled.\nPR:L - SMB2 LOCK requires a valid SMB session, tree connection, and session-owned open file handle. Any ordinary authenticated share user suffices; administrative privileges are unnecessary.\nUI:N - The attacker can create the handles, conflicting locks, and cancellation requests without any victim action.\nS:U - The UAF occurs within the host kernel\u0027s ksmbd security authority and does not inherently cross a separate virtualization or sandbox boundary.\nC:H - The file_lock UAF permits attacker-influenced slab reuse and stale kernel-pointer dereferences, making kernel memory disclosure defensible.\nI:H - The stale callback performs list deletion and wait-queue operations through freed or reallocated fields, enabling kernel heap corruption, arbitrary-write primitives, and potential code execution.\nA:H - The UAF reaches __locks_delete_block or __wake_up_common and can cause a kernel oops or panic; a remote attacker can repeatedly retrigger it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:34.061Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2"
},
{
"url": "https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9"
},
{
"url": "https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e"
},
{
"url": "https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3"
},
{
"url": "https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8"
},
{
"url": "https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e"
}
],
"title": "ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64396",
"datePublished": "2026-07-25T08:50:40.993Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:34.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64397 (GCVE-0-2026-64397)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
ksmbd: serialize QUERY_DIRECTORY requests per file
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: serialize QUERY_DIRECTORY requests per file
smb2_query_dir() stores a pointer to its stack-allocated private data in
the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the
same file handle can overwrite this pointer while an iterate_dir() callback
is still using it, resulting in a stack use-after-free.
Add a per-file mutex and hold it while accessing the shared directory
enumeration state. The lock covers scan restart, dot entry state,
readdir_data setup and iteration, and response construction. This prevents
another request from replacing readdir_data.private before the current
request has finished using it and also serializes the shared file position.
Severity
9.8 (Critical)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 1426fd79102539bc0ab5c8fced047ad4313b9908
(git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 2a64dbf9c739ddf7a25a066507597bf89f8f73d2 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 64dac2d486ec1eb18dc00968b16a230b6b75ec24 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < fd22b039a5a05bc1d6818e9dcd1001fb432a829d (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < be6d26bf27499977c746abc163659915082348d8 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/vfs_cache.c",
"fs/smb/server/vfs_cache.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1426fd79102539bc0ab5c8fced047ad4313b9908",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "2a64dbf9c739ddf7a25a066507597bf89f8f73d2",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "64dac2d486ec1eb18dc00968b16a230b6b75ec24",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "fd22b039a5a05bc1d6818e9dcd1001fb432a829d",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "be6d26bf27499977c746abc163659915082348d8",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/vfs_cache.c",
"fs/smb/server/vfs_cache.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: serialize QUERY_DIRECTORY requests per file\n\nsmb2_query_dir() stores a pointer to its stack-allocated private data in\nthe ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the\nsame file handle can overwrite this pointer while an iterate_dir() callback\nis still using it, resulting in a stack use-after-free.\n\nAdd a per-file mutex and hold it while accessing the shared directory\nenumeration state. The lock covers scan restart, dot entry state,\nreaddir_data setup and iteration, and response construction. This prevents\nanother request from replacing readdir_data.private before the current\nrequest has finished using it and also serializes the shared file position."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - KSMBD processes attacker-supplied SMB2 QUERY_DIRECTORY requests over TCP port 445, so the vulnerable callback is remotely reachable.\nAC:L - The attacker controls both concurrent requests using the same directory handle and can prolong one enumeration while rapidly completing the other, making the race repeatable.\nPR:N - Although a valid session, tree connection, and readable directory handle are required, ksmbd supports passwordless guest sessions; a guest-readable share therefore permits exploitation without pre-existing privileges.\nUI:N - No victim action is required after the SMB server and accessible share are available.\nS:U - Exploitation compromises the kernel hosting the SMB server without crossing a separate virtualization, sandbox, or IOMMU security authority.\nC:H - The stack use-after-free exposes stale stack, work, search-pattern, and response-buffer pointers, providing a defensible path to high-impact kernel memory disclosure.\nI:H - The callback writes attacker-influenced directory-entry data through a stale d_info pointer and modifies reclaimed stack or response-buffer memory, potentially enabling arbitrary corruption and code execution.\nA:H - Dereferencing or writing through the freed stack and associated stale heap pointers can cause a kernel oops or panic, and the attacker can trigger the race repeatedly over the network."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:35.141Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908"
},
{
"url": "https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2"
},
{
"url": "https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24"
},
{
"url": "https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199"
},
{
"url": "https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d"
},
{
"url": "https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8"
}
],
"title": "ksmbd: serialize QUERY_DIRECTORY requests per file",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64397",
"datePublished": "2026-07-25T08:50:41.620Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:35.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64398 (GCVE-0-2026-64398)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via
ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after
checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no
per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES
still yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of
FILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it
O_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only
the missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with
KASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle
zeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to
(6/6; a FILE_READ_DATA-only handle was correctly denied).
This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL
permission bypass by adding a permission check for FSCTL_SET_SPARSE").
Because SET_ZERO_DATA writes data (not an attribute), require
FILE_WRITE_DATA.
Severity
8.1 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 25377f369688dd0bd814dc8965ed26d44238ecaa
(git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 3072d82461f498c85daea8766e9d8bfbada31605 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < ca53bb17f4e8232cfaece3953d3cef62c559b039 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < deffa929086d7902e30918adf3dd27ccfe9c08b1 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 3320ba068198adc144c89d6661b805acce01735b (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25377f369688dd0bd814dc8965ed26d44238ecaa",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "3072d82461f498c85daea8766e9d8bfbada31605",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "ca53bb17f4e8232cfaece3953d3cef62c559b039",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "deffa929086d7902e30918adf3dd27ccfe9c08b1",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
},
{
"lessThan": "3320ba068198adc144c89d6661b805acce01735b",
"status": "affected",
"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a permission check for FSCTL_SET_ZERO_DATA\n\nFSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via\nksmbd_vfs_zero_data() -\u003e vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after\nchecking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no\nper-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES\nstill yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of\nFILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it\nO_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only\nthe missing fp-\u003edaccess gate would. Reproduced on mainline 7.1-rc7 with\nKASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle\nzeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to\n(6/6; a FILE_READ_DATA-only handle was correctly denied).\n\nThis is the unfixed sibling of commit cc57232cae23 (\"ksmbd: fix FSCTL\npermission bypass by adding a permission check for FSCTL_SET_SPARSE\").\nBecause SET_ZERO_DATA writes data (not an attribute), require\nFILE_WRITE_DATA."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable ksmbd handler processes SMB2 IOCTL requests received remotely over SMB on TCP port 445.\nAC:L - An attacker can deterministically open a metadata-only handle and submit one or more SET_ZERO_DATA requests with attacker-controlled ranges; no race or uncontrollable condition is required.\nPR:L - The path requires a valid SMB session, access to a writable share, and permission to open the target with FILE_WRITE_ATTRIBUTES, but it does not require administrative privileges.\nUI:N - Exploitation occurs entirely through attacker-generated SMB requests and requires no victim action.\nS:U - The flaw corrupts files managed by the same ksmbd host and does not cross a VM, sandbox, or other security-authority boundary.\nC:N - The operation only zeros or deallocates file ranges; it provides no data-read primitive, information disclosure, or kernel-memory corruption.\nI:H - The attacker can persistently zero arbitrary selected ranges, including an entire file, despite lacking FILE_WRITE_DATA permission; SET_ZERO_DATA is explicitly a file-content modification operation ([Microsoft MS-FSCC](https://learn.microsoft.com/en-us/openspecs/windows_protoco ls/ms-fscc/6be5164f-3eb6-4149-b997-c37df1444779)).\nA:H - Repeatedly erasing critical databases, configurations, firmware images, or application data on an SMB share can cause complete and persistent service or resource unavailability until restoration."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:36.210Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa"
},
{
"url": "https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605"
},
{
"url": "https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039"
},
{
"url": "https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7"
},
{
"url": "https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1"
},
{
"url": "https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b"
}
],
"title": "ksmbd: add a permission check for FSCTL_SET_ZERO_DATA",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64398",
"datePublished": "2026-07-25T08:50:42.221Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:36.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64399 (GCVE-0-2026-64399)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the
destination file's data via vfs_clone_file_range() with neither the
share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle
fp->daccess check that the other write-bearing arms carry. A client can
overwrite destination data on a read-only share, or from a handle opened
with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).
FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via
the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;
require FILE_WRITE_DATA since this writes data.
Severity
9.8 (Critical)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
eb817368f50c1cbe1bd07044124aad7db6330e3a , < bf460ad5958d506492de4524a656439da3f99c51
(git)
Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < 620d133d469295ee7c017ca6aafac335f65c4a5a (git) Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < 9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6 (git) Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < baae7b39673ec21073a25e3d14f8feaada01d5df (git) Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < c917e4522d251071dde9871b9142d8ea1186ebfe (git) Affected: eb817368f50c1cbe1bd07044124aad7db6330e3a , < 388e4139db27a9e3612c9d356b826f5b1ff6a9e3 (git) |
|
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf460ad5958d506492de4524a656439da3f99c51",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "620d133d469295ee7c017ca6aafac335f65c4a5a",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "baae7b39673ec21073a25e3d14f8feaada01d5df",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "c917e4522d251071dde9871b9142d8ea1186ebfe",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
},
{
"lessThan": "388e4139db27a9e3612c9d356b826f5b1ff6a9e3",
"status": "affected",
"version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE\n\nThe FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the\ndestination file\u0027s data via vfs_clone_file_range() with neither the\nshare-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle\nfp-\u003edaccess check that the other write-bearing arms carry. A client can\noverwrite destination data on a read-only share, or from a handle opened\nwith only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).\nFILE_WRITE_ATTRIBUTES-only destination handle overwrote the file\u0027s data via\nthe clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;\nrequire FILE_WRITE_DATA since this writes data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An attacker reaches smb2_ioctl() remotely through ksmbd\u2019s SMB service on TCP port 445.\nAC:L - The attacker directly controls both file handles, offsets, length, and request timing; no race or uncontrollable condition is required on a clone-capable filesystem.\nPR:N - A passwordless guest session on a guest-enabled share can obtain the required session, tree connection, and file handles without credentials.\nUI:N - The attacker independently negotiates the SMB session, opens the files, and submits the malicious IOCTL without victim action.\nS:U - The unauthorized file modification and any resulting code execution remain within the host kernel and services governed by the same security authority.\nC:H - In a plausible share containing service-loaded code or configuration, attacker-controlled extent replacement can yield code execution and consequent access to sensitive data.\nI:H - The attacker can overwrite arbitrary destination ranges with chosen source data despite a read-only share or a handle lacking FILE_WRITE_DATA.\nA:H - Repeated or complete corruption of critical files, databases, executables, or service configuration can cause a persistent loss of the affected system or service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:37.295Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51"
},
{
"url": "https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a"
},
{
"url": "https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6"
},
{
"url": "https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df"
},
{
"url": "https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe"
},
{
"url": "https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3"
}
],
"title": "ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64399",
"datePublished": "2026-07-25T08:50:42.925Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:37.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64401 (GCVE-0-2026-64401)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
smb: client: resolve SWN tcon from live registrations
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: resolve SWN tcon from live registrations
cifs_swn_notify() looks up a witness registration by id under
cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's
cached tcon pointer. That pointer is not a lifetime reference, and it is
not a stable representative once cifs_get_swn_reg() lets multiple tcons
for the same net/share name share one registration id.
A same-share second mount can keep the cifs_swn_reg alive after the first
tcon unregisters and is freed. The registration then still points at the
freed first tcon, so taking tc_lock or incrementing tc_count through
swnreg->tcon only moves the use-after-free earlier. Taking tc_lock while
holding cifs_swnreg_idr_mutex also violates the documented CIFS lock
order.
Fix this by making the registration store only the stable witness
identity: id, net name, share name, and notify flags. When a notify
arrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,
then find and pin a live witness tcon that currently matches the net/share
pair under the normal cifs_tcp_ses_lock -> tc_lock order. The notification
path uses that pinned tcon directly and drops the reference when done.
Registration and unregister messages now use the live tcon passed by the
caller instead of a cached tcon in the registration. The final unregister
send is folded into cifs_swn_unregister() while the registration is still
protected by cifs_swnreg_idr_mutex. This removes the previous
find/drop/reacquire raw-pointer window. The release path only removes the
idr entry and frees the stable identity strings.
This preserves the intended one-registration/many-tcon behavior: a
registration id represents a net/share pair, and notify handling acts on a
live representative selected at use time. It also preserves CLIENT_MOVE
ordering for the representative tcon because the old-IP unregister is sent
before cifs_swn_register() sends the new-IP register.
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 , < 51d18db392e5386a7bb9e816d611f14e600cca3c
(git)
Affected: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 , < aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd (git) Affected: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 , < 945b4a4a54497db1dcb2f20ef801a84e884dac21 (git) Affected: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 , < 91b8a58c6ac15c7db6518f696389933282f88da7 (git) Affected: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 , < 0700f946659d0ab2352ec8a9b1c6fc74b13a27d7 (git) Affected: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 , < ec457f9afe5ae9538bdcd58fd4cb442b9787e183 (git) |
|
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifs_swn.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51d18db392e5386a7bb9e816d611f14e600cca3c",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "945b4a4a54497db1dcb2f20ef801a84e884dac21",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "91b8a58c6ac15c7db6518f696389933282f88da7",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "0700f946659d0ab2352ec8a9b1c6fc74b13a27d7",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "ec457f9afe5ae9538bdcd58fd4cb442b9787e183",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifs_swn.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: resolve SWN tcon from live registrations\n\ncifs_swn_notify() looks up a witness registration by id under\ncifs_swnreg_idr_mutex, drops the mutex, and then uses the registration\u0027s\ncached tcon pointer. That pointer is not a lifetime reference, and it is\nnot a stable representative once cifs_get_swn_reg() lets multiple tcons\nfor the same net/share name share one registration id.\n\nA same-share second mount can keep the cifs_swn_reg alive after the first\ntcon unregisters and is freed. The registration then still points at the\nfreed first tcon, so taking tc_lock or incrementing tc_count through\nswnreg-\u003etcon only moves the use-after-free earlier. Taking tc_lock while\nholding cifs_swnreg_idr_mutex also violates the documented CIFS lock\norder.\n\nFix this by making the registration store only the stable witness\nidentity: id, net name, share name, and notify flags. When a notify\narrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,\nthen find and pin a live witness tcon that currently matches the net/share\npair under the normal cifs_tcp_ses_lock -\u003e tc_lock order. The notification\npath uses that pinned tcon directly and drops the reference when done.\n\nRegistration and unregister messages now use the live tcon passed by the\ncaller instead of a cached tcon in the registration. The final unregister\nsend is folded into cifs_swn_unregister() while the registration is still\nprotected by cifs_swnreg_idr_mutex. This removes the previous\nfind/drop/reacquire raw-pointer window. The release path only removes the\nidr entry and frees the stable identity strings.\n\nThis preserves the intended one-registration/many-tcon behavior: a\nregistration id represents a net/share pair, and notify handling acts on a\nlive representative selected at use time. It also preserves CLIENT_MOVE\nordering for the representative tcon because the old-IP unregister is sent\nbefore cifs_swn_register() sends the new-IP register."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is locally reachable through the world-readable /proc/fs/cifs/DebugData path and, on earlier affected kernels, unrestricted SWN generic-netlink notifications.\nAC:L - A same-share second mount deterministically preserves the registration after the first tcon is freed; repeated proc reads or notifications then dereference the stale pointer without requiring an uncontrollable race.\nPR:L - An unprivileged local user can read /proc/fs/cifs/DebugData, and affected kernels predating the companion netlink authorization fix also allowed unprivileged SWN_NOTIFY messages. User namespaces do not grant CIFS mount authority, but no mount privilege is needed once normal mount turnover creates the stale registration.\nUI:N - Once a witness-enabled registration exists, exploitation requires no further victim action; the attacker can invoke the local trigger directly.\nS:U - Successful exploitation compromises the host kernel within the same security authority and does not inherently cross a VM, IOMMU, or other scope boundary.\nC:H - The heap UAF involves attacker-reclaimable cifs_tcon and cifs_swn_reg objects whose pointer chains reach session credentials and arbitrary kernel memory, enabling high-impact disclosure primitives.\nI:H - Reclaiming the freed objects can redirect client-move and reconnect operations through attacker-influenced pointers, providing arbitrary-write and control-flow-hijacking potential.\nA:H - Dereferencing the freed tcon or registration can cause an immediate kernel oops or panic, and the periodic echo worker can repeatedly exercise the stale pointer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:39.438Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51d18db392e5386a7bb9e816d611f14e600cca3c"
},
{
"url": "https://git.kernel.org/stable/c/aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd"
},
{
"url": "https://git.kernel.org/stable/c/945b4a4a54497db1dcb2f20ef801a84e884dac21"
},
{
"url": "https://git.kernel.org/stable/c/91b8a58c6ac15c7db6518f696389933282f88da7"
},
{
"url": "https://git.kernel.org/stable/c/0700f946659d0ab2352ec8a9b1c6fc74b13a27d7"
},
{
"url": "https://git.kernel.org/stable/c/ec457f9afe5ae9538bdcd58fd4cb442b9787e183"
}
],
"title": "smb: client: resolve SWN tcon from live registrations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64401",
"datePublished": "2026-07-25T08:50:44.361Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:39.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64403 (GCVE-0-2026-64403)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-05 12:41
VLAI
EPSS
VEX
Title
Bluetooth: L2CAP: validate option length before reading conf opt value
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: validate option length before reading conf opt value
l2cap_get_conf_opt() derives the option length from the
attacker-controlled opt->len field and immediately dereferences
opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a
raw pointer for the default case) before any caller has confirmed
that opt->len bytes are present in the buffer. The callers
(l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and
l2cap_conf_rfc_get()) only detect a malformed option afterwards, once
the running length has gone negative, by which point the
out-of-bounds read has already executed.
An existing post-hoc length check keeps the garbage value from being
consumed, so this is not a data leak in the current control flow. It
is still a validate-after-use ordering bug: up to 4 bytes are read
past the end of the buffer before it is known to contain them, and it
is fragile to future changes in the callers.
Fix it at the source. Pass the end of the buffer into
l2cap_get_conf_opt() and refuse to touch opt->val unless the full
option (header + value) fits. Each caller computes an end pointer
once before the loop and checks the return value directly instead of
inferring the error from a negative length.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 , < cca81b4bc672604a84f6d224a55cc77ec7dee619
(git)
Affected: 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 , < f70d4aa88068096f35d73e3a05eff33c0a16b9cd (git) Affected: 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 , < 7d871e969b941ce25653f7716203a0ea4d07ad4b (git) Affected: 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 , < 98d93c226bdfaa79bbdd86981921d7f106374225 (git) Affected: 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 , < 996d3da39899aceb8f4910911a3f19a45a7d9d1b (git) Affected: 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 , < 73abbaf91aa33da87c008fb62c148ade561bb606 (git) Affected: 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 , < 6b47bdaacfd0045687880177e0987055d8f4765a (git) Affected: 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69 , < 687617555cedfb74c9e3cb85d759b908dcb17856 (git) Affected: 78c2887130f1a7d1883195732be1b6cdab667487 (git) Affected: ac7c597c465eb09391e40febbe088bdad601080b (git) Affected: ade4560e4fea198866e033fe1c02f063d6d7db2e (git) Affected: 99665dcf6ff803351b5e658f3a929cb498561e36 (git) Affected: 2b59d36f22622c92c0b06aee7571f0a86a217188 (git) Affected: 15d6538a0d6e0f6de5116081a948cba7cc3e1d3d (git) Affected: a556547bae00528f24b42786b41a14047db14b84 (git) Affected: 3.16.66 , < 3.17 (semver) Affected: 3.18.138 , < 3.19 (semver) Affected: 4.4.178 , < 4.5 (semver) Affected: 4.9.167 , < 4.10 (semver) Affected: 4.14.110 , < 4.15 (semver) Affected: 4.19.33 , < 4.20 (semver) Affected: 5.0.6 , < 5.1 (semver) |
|
| Linux | Linux |
Affected:
5.1
Unaffected: 0 , < 5.1 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cca81b4bc672604a84f6d224a55cc77ec7dee619",
"status": "affected",
"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69",
"versionType": "git"
},
{
"lessThan": "f70d4aa88068096f35d73e3a05eff33c0a16b9cd",
"status": "affected",
"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69",
"versionType": "git"
},
{
"lessThan": "7d871e969b941ce25653f7716203a0ea4d07ad4b",
"status": "affected",
"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69",
"versionType": "git"
},
{
"lessThan": "98d93c226bdfaa79bbdd86981921d7f106374225",
"status": "affected",
"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69",
"versionType": "git"
},
{
"lessThan": "996d3da39899aceb8f4910911a3f19a45a7d9d1b",
"status": "affected",
"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69",
"versionType": "git"
},
{
"lessThan": "73abbaf91aa33da87c008fb62c148ade561bb606",
"status": "affected",
"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69",
"versionType": "git"
},
{
"lessThan": "6b47bdaacfd0045687880177e0987055d8f4765a",
"status": "affected",
"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69",
"versionType": "git"
},
{
"lessThan": "687617555cedfb74c9e3cb85d759b908dcb17856",
"status": "affected",
"version": "7c9cbd0b5e38a1672fcd137894ace3b042dfbf69",
"versionType": "git"
},
{
"status": "affected",
"version": "78c2887130f1a7d1883195732be1b6cdab667487",
"versionType": "git"
},
{
"status": "affected",
"version": "ac7c597c465eb09391e40febbe088bdad601080b",
"versionType": "git"
},
{
"status": "affected",
"version": "ade4560e4fea198866e033fe1c02f063d6d7db2e",
"versionType": "git"
},
{
"status": "affected",
"version": "99665dcf6ff803351b5e658f3a929cb498561e36",
"versionType": "git"
},
{
"status": "affected",
"version": "2b59d36f22622c92c0b06aee7571f0a86a217188",
"versionType": "git"
},
{
"status": "affected",
"version": "15d6538a0d6e0f6de5116081a948cba7cc3e1d3d",
"versionType": "git"
},
{
"status": "affected",
"version": "a556547bae00528f24b42786b41a14047db14b84",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.66",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.138",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.178",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.167",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.110",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.33",
"versionType": "semver"
},
{
"lessThan": "5.1",
"status": "affected",
"version": "5.0.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2-rc3",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.138",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.178",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate option length before reading conf opt value\n\nl2cap_get_conf_opt() derives the option length from the\nattacker-controlled opt-\u003elen field and immediately dereferences\nopt-\u003eval (as u8, get_unaligned_le16() or get_unaligned_le32(), or a\nraw pointer for the default case) before any caller has confirmed\nthat opt-\u003elen bytes are present in the buffer. The callers\n(l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and\nl2cap_conf_rfc_get()) only detect a malformed option afterwards, once\nthe running length has gone negative, by which point the\nout-of-bounds read has already executed.\n\nAn existing post-hoc length check keeps the garbage value from being\nconsumed, so this is not a data leak in the current control flow. It\nis still a validate-after-use ordering bug: up to 4 bytes are read\npast the end of the buffer before it is known to contain them, and it\nis fragile to future changes in the callers.\n\nFix it at the source. Pass the end of the buffer into\nl2cap_get_conf_opt() and refuse to touch opt-\u003eval unless the full\noption (header + value) fits. Each caller computes an end pointer\nonce before the loop and checks the return value directly instead of\ninferring the error from a negative length."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable parser processes attacker-controlled BR/EDR L2CAP configuration packets received from a Bluetooth peer within radio range.\nAC:L - A malformed option with a declared length exceeding the remaining buffer directly triggers the invalid read; no race or condition outside the attacker\u0027s control is required.\nPR:N - An unauthenticated Bluetooth peer can establish an SDP L2CAP channel, for which Linux bypasses the normal link-security check, and then submit configuration packets.\nUI:N - Once the Bluetooth interface is connectable with an applicable listening service, the peer can establish the channel and send the malformed option without victim action.\nS:U - The vulnerable Bluetooth parser and the resulting kernel impact are within the same host kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:L - The invalid read is strictly bounded to at most four adjacent bytes. Although the post-hoc check prevents the value from being consumed in the current protocol flow, limited confidentiality impact is the higher defensible choice.\nI:N - The flaw performs only an out-of-bounds read, and the invalid value is discarded before option-specific processing; there is no memory write or control-flow corruption primitive.\nA:H - The invalid kernel read can produce an oops or panic when it reaches an inaccessible or hardened boundary, and an unauthenticated adjacent peer can repeatedly send malformed configuration options."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:41:41.618Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cca81b4bc672604a84f6d224a55cc77ec7dee619"
},
{
"url": "https://git.kernel.org/stable/c/f70d4aa88068096f35d73e3a05eff33c0a16b9cd"
},
{
"url": "https://git.kernel.org/stable/c/7d871e969b941ce25653f7716203a0ea4d07ad4b"
},
{
"url": "https://git.kernel.org/stable/c/98d93c226bdfaa79bbdd86981921d7f106374225"
},
{
"url": "https://git.kernel.org/stable/c/996d3da39899aceb8f4910911a3f19a45a7d9d1b"
},
{
"url": "https://git.kernel.org/stable/c/73abbaf91aa33da87c008fb62c148ade561bb606"
},
{
"url": "https://git.kernel.org/stable/c/6b47bdaacfd0045687880177e0987055d8f4765a"
},
{
"url": "https://git.kernel.org/stable/c/687617555cedfb74c9e3cb85d759b908dcb17856"
}
],
"title": "Bluetooth: L2CAP: validate option length before reading conf opt value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64403",
"datePublished": "2026-07-25T08:50:45.796Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-05T12:41:41.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…