https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T18:10:27.120683+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-46155 CVE-2026-46155 — smb/client: fix out-of-bounds read in smb2_compound_op() 2026-10-08T18:10:27.167544+00:00

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix out-of-bounds read in smb2_compound_op()

If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len.

Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]);

Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.

 https://cve.radiocsirt.org/vuln/rhsa-2026:36018 RHSA-2026:36018 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update 2026-10-08T18:10:27.167615+00:00

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete kernel: smb/client: fix out-of-bounds read in smb2_compound_op() kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs