https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:59:22 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-52996 <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-52996 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/euvd-2026-329927 EUVD-2026-329927 https://cve.radiocsirt.org/vuln/euvd-2026-329927 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52996 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open</p> <p>ksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount incremented via ksmbd_fp_get(). parse_durable_handle_context() in the DURABLE_REQ_V2 case properly releases this reference on every path inside the ClientGUID-match branch, either by calling ksmbd_put_durable_fd() or by transferring ownership to dh_info-&gt;fp for a successful reconnect. However, when an entry exists in the global file table with the same CreateGuid but a different ClientGUID, the code simply falls through to the new-open path without dropping the reference obtained from ksmbd_lookup_fd_cguid().</p> <p>Per MS-SMB2 section 3.3.5.9.10 (&#34;Handling the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context&#34;), the server MUST locate an Open whose Open.CreateGuid matches the request&#39;s CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the connection that received the request. If no such Open is found, the server MUST continue with the normal open execution phase. A CreateGuid hit with a ClientGUID mismatch is therefore the &#34;Open not found&#34; case: proceeding with a new open is correct, but the reference obtained purely as a side effect of the lookup must not be leaked.</p> <p>Repeated requests that hit this mismatch pin global_ft entries, prevent __ksmbd_close_fd() from ever running for the corresponding files, and defeat the durable scavenger, leading to long-lived resourc…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open</p> <p>ksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount incremented via ksmbd_fp_get(). parse_durable_handle_context() in the DURABLE_REQ_V2 case properly releases this reference on every path inside the ClientGUID-match branch, either by calling ksmbd_put_durable_fd() or by transferring ownership to dh_info-&gt;fp for a successful reconnect. However, when an entry exists in the global file table with the same CreateGuid but a different ClientGUID, the code simply falls through to the new-open path without dropping the reference obtained from ksmbd_lookup_fd_cguid().</p> <p>Per MS-SMB2 section 3.3.5.9.10 (&#34;Handling the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context&#34;), the server MUST locate an Open whose Open.CreateGuid matches the request&#39;s CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the connection that received the request. If no such Open is found, the server MUST continue with the normal open execution phase. A CreateGuid hit with a ClientGUID mismatch is therefore the &#34;Open not found&#34; case: proceeding with a new open is correct, but the reference obtained purely as a side effect of the lookup must not be leaked.</p> <p>Repeated requests that hit this mismatch pin global_ft entries, prevent __ksmbd_close_fd() from ever running for the corresponding files, and defeat the durable scavenger, leading to long-lived resourc…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52996 https://cve.radiocsirt.org/vuln/ghsa-w2x4-6hp6-4hc7 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open</p> <p>ksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount incremented via ksmbd_fp_get(). parse_durable_handle_context() in the DURABLE_REQ_V2 case properly releases this reference on every path inside the ClientGUID-match branch, either by calling ksmbd_put_durable_fd() or by transferring ownership to dh_info-&gt;fp for a successful reconnect. However, when an entry exists in the global file table with the same CreateGuid but a different ClientGUID, the code simply falls through to the new-open path without dropping the reference obtained from ksmbd_lookup_fd_cguid().</p> <p>Per MS-SMB2 section 3.3.5.9.10 (&#34;Handling the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context&#34;), the server MUST locate an Open whose Open.CreateGuid matches the request&#39;s CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the connection that received the request. If no such Open is found, the server MUST continue with the normal open execution phase. A CreateGuid hit with a ClientGUID mismatch is therefore the &#34;Open not found&#34; case: proceeding with a new open is correct, but the reference obtained purely as a side effect of the lookup must not be leaked.</p> <p>Repeated requests that hit this mismatch pin global_ft entries, prevent __ksmbd_close_fd() from ever running for the corresponding files, and defeat the durable scavenger, leading to long-lived resourc…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open</p> <p>ksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount incremented via ksmbd_fp_get(). parse_durable_handle_context() in the DURABLE_REQ_V2 case properly releases this reference on every path inside the ClientGUID-match branch, either by calling ksmbd_put_durable_fd() or by transferring ownership to dh_info-&gt;fp for a successful reconnect. However, when an entry exists in the global file table with the same CreateGuid but a different ClientGUID, the code simply falls through to the new-open path without dropping the reference obtained from ksmbd_lookup_fd_cguid().</p> <p>Per MS-SMB2 section 3.3.5.9.10 (&#34;Handling the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context&#34;), the server MUST locate an Open whose Open.CreateGuid matches the request&#39;s CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the connection that received the request. If no such Open is found, the server MUST continue with the normal open execution phase. A CreateGuid hit with a ClientGUID mismatch is therefore the &#34;Open not found&#34; case: proceeding with a new open is correct, but the reference obtained purely as a side effect of the lookup must not be leaked.</p> <p>Repeated requests that hit this mismatch pin global_ft entries, prevent __ksmbd_close_fd() from ever running for the corresponding files, and defeat the durable scavenger, leading to long-lived resourc…</p> https://cve.radiocsirt.org/vuln/ghsa-w2x4-6hp6-4hc7 https://cve.radiocsirt.org/vuln/msrc_cve-2026-52996 msrc_CVE-2026-52996 https://cve.radiocsirt.org/vuln/msrc_cve-2026-52996 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-52996 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 127 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open ksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount incremented via ksmbd_fp_get(). parse_durable_handle_context() in the DURABLE_REQ_V2 case properly releases this reference on every path inside the ClientGUID-match branch, either by calling ksmbd_put_durable_fd() or by transferring ownership to dh_info-&gt;fp for a successful reconnect. However, when an entry exists in the global file table with the same CreateGuid but a different ClientGUID, the code simply falls through to the new-open path without dropping the reference obtained from ksmbd_lookup_fd_cguid(). Per MS-SMB2 section 3.3.5.9.10 (&#34;Handling the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context&#34;), the server MUST locate an Open whose Open.CreateGuid matches the request&#39;s CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the connection that received the request. If no such Open is found, the server MUST continue with the normal open execution phase. A CreateGuid hit with a ClientGUID mismatch is therefore the &#34;Open not found&#34; case: proceeding with a new open is correct, but the reference obtained purely as a side effect of the lookup must not be leaked. Repeated requests that hit this mismatch pin global_ft entries, prevent __ksmbd_close_fd() from ever running for the corresponding files, and defeat the durable scavenger, leading to long-lived resource le…</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 127 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open ksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount incremented via ksmbd_fp_get(). parse_durable_handle_context() in the DURABLE_REQ_V2 case properly releases this reference on every path inside the ClientGUID-match branch, either by calling ksmbd_put_durable_fd() or by transferring ownership to dh_info-&gt;fp for a successful reconnect. However, when an entry exists in the global file table with the same CreateGuid but a different ClientGUID, the code simply falls through to the new-open path without dropping the reference obtained from ksmbd_lookup_fd_cguid(). Per MS-SMB2 section 3.3.5.9.10 (&#34;Handling the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context&#34;), the server MUST locate an Open whose Open.CreateGuid matches the request&#39;s CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the connection that received the request. If no such Open is found, the server MUST continue with the normal open execution phase. A CreateGuid hit with a ClientGUID mismatch is therefore the &#34;Open not found&#34; case: proceeding with a new open is correct, but the reference obtained purely as a side effect of the lookup must not be leaked. Repeated requests that hit this mismatch pin global_ft entries, prevent __ksmbd_close_fd() from ever running for the corresponding files, and defeat the durable scavenger, leading to long-lived resource le…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-52996 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2077 <p>Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen und weitere, nicht näher spezifizierte Auswirkungen zu erzielen.</p> <p>Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen und weitere, nicht näher spezifizierte Auswirkungen zu erzielen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2077