https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:28:06 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10730 bdu:2026-10730 https://cve.radiocsirt.org/vuln/bdu:2026-10730 https://cve.radiocsirt.org/vuln/bell-cve-2026-31705 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-31705 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0526 certfr-2026-avi-0526 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0526 https://cve.radiocsirt.org/vuln/euvd-2026-347770 EUVD-2026-347770 https://cve.radiocsirt.org/vuln/euvd-2026-347770 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31705 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment</p> <p>smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space.</p> <p>When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory.</p> <p>Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes.</p> <p>This is the same bug pattern fixed by commit beef2634f81f (&#34;ksmbd: fix potencial OOB in get_file_all_info() for compound requests&#34;) and commit fda9522ed6af (&#34;ksmbd: fix OOB write in QUERY_INFO for compound requests&#34;), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment</p> <p>smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space.</p> <p>When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory.</p> <p>Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes.</p> <p>This is the same bug pattern fixed by commit beef2634f81f (&#34;ksmbd: fix potencial OOB in get_file_all_info() for compound requests&#34;) and commit fda9522ed6af (&#34;ksmbd: fix OOB write in QUERY_INFO for compound requests&#34;), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-31705 https://cve.radiocsirt.org/vuln/ghsa-5jgf-2w89-7334 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment</p> <p>smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space.</p> <p>When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory.</p> <p>Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes.</p> <p>This is the same bug pattern fixed by commit beef2634f81f (&#34;ksmbd: fix potencial OOB in get_file_all_info() for compound requests&#34;) and commit fda9522ed6af (&#34;ksmbd: fix OOB write in QUERY_INFO for compound requests&#34;), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment</p> <p>smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space.</p> <p>When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory.</p> <p>Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes.</p> <p>This is the same bug pattern fixed by commit beef2634f81f (&#34;ksmbd: fix potencial OOB in get_file_all_info() for compound requests&#34;) and commit fda9522ed6af (&#34;ksmbd: fix OOB write in QUERY_INFO for compound requests&#34;), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.</p> https://cve.radiocsirt.org/vuln/ghsa-5jgf-2w89-7334 https://cve.radiocsirt.org/vuln/msrc_cve-2026-31705 msrc_CVE-2026-31705 https://cve.radiocsirt.org/vuln/msrc_cve-2026-31705 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10793-1 <p>kernel-devel-7.0.7-1.1 on GA media</p> <p>kernel-devel-7.0.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10793-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31705 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 187 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (&#34;ksmbd: fix potencial OOB in get_file_all_info() for compound requests&#34;) and commit fda9522ed6af (&#34;ksmbd: fix OOB write in QUERY_INFO for compound requests&#34;), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 187 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f (&#34;ksmbd: fix potencial OOB in get_file_all_info() for compound requests&#34;) and commit fda9522ed6af (&#34;ksmbd: fix OOB write in QUERY_INFO for compound requests&#34;), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31705 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1346 <p>Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Root-Rechte zu erlangen, um Sicherheitsmechanismen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder Auswirkungen unbestimmter Art zu erzielen.</p> <p>Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Root-Rechte zu erlangen, um Sicherheitsmechanismen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder Auswirkungen unbestimmter Art zu erzielen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1346