https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:31:54 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-80926 <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-80926 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1253 certfr-2026-avi-1253 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1253 https://cve.radiocsirt.org/vuln/euvd-2026-372827 EUVD-2026-372827 https://cve.radiocsirt.org/vuln/euvd-2026-372827 https://cve.radiocsirt.org/vuln/fkie_cve-2026-80926 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix use-after-free in oplock break notification</p> <p>smb2_oplock_break_noti() reads opinfo-&gt;conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo-&gt;conn and drops its conn reference under ci-&gt;m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock.</p> <p>Thread the caller&#39;s inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target&#39;s oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo-&gt;o_fp, which a concurrent close may free. Select and pin the connection under ci-&gt;m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo-&gt;conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to th…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix use-after-free in oplock break notification</p> <p>smb2_oplock_break_noti() reads opinfo-&gt;conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo-&gt;conn and drops its conn reference under ci-&gt;m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock.</p> <p>Thread the caller&#39;s inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target&#39;s oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo-&gt;o_fp, which a concurrent close may free. Select and pin the connection under ci-&gt;m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo-&gt;conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to th…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-80926 https://cve.radiocsirt.org/vuln/ghsa-4r76-cqqc-v36j <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix use-after-free in oplock break notification</p> <p>smb2_oplock_break_noti() reads opinfo-&gt;conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo-&gt;conn and drops its conn reference under ci-&gt;m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock.</p> <p>Thread the caller&#39;s inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target&#39;s oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo-&gt;o_fp, which a concurrent close may free. Select and pin the connection under ci-&gt;m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo-&gt;conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to th…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix use-after-free in oplock break notification</p> <p>smb2_oplock_break_noti() reads opinfo-&gt;conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo-&gt;conn and drops its conn reference under ci-&gt;m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock.</p> <p>Thread the caller&#39;s inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target&#39;s oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo-&gt;o_fp, which a concurrent close may free. Select and pin the connection under ci-&gt;m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo-&gt;conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to th…</p> https://cve.radiocsirt.org/vuln/ghsa-4r76-cqqc-v36j https://cve.radiocsirt.org/vuln/msrc_cve-2026-80926 msrc_CVE-2026-80926 https://cve.radiocsirt.org/vuln/msrc_cve-2026-80926 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11805-1 <p>kernel-devel-7.2.6-1.1 on GA media</p> <p>kernel-devel-7.2.6-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11805-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-80926 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 118 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opinfo-&gt;conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo-&gt;conn and drops its conn reference under ci-&gt;m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock. Thread the caller&#39;s inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target&#39;s oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo-&gt;o_fp, which a concurrent close may free. Select and pin the connection under ci-&gt;m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo-&gt;conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to the w…</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 118 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opinfo-&gt;conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected, session_fd_check() clears opinfo-&gt;conn and drops its conn reference under ci-&gt;m_lock, and the last ksmbd_conn_put() frees the connection. A break triggered by another connection that races with the teardown can then resurrect the freed connection: ksmbd_conn_get() is a plain atomic_inc, and the queued break work later dereferences the stale conn via ksmbd_conn_write(), a use-after-free reachable by any authenticated client holding a durable batch oplock. Thread the caller&#39;s inode into the notification path instead of taking a new reference on it. Every caller of oplock_break() already holds a live ksmbd_file (or an explicit ksmbd_inode_lookup_lock() reference, in the parent lease break paths) on the inode that owns the break target&#39;s oplock list, so ci cannot be freed during the call, and its lock can be taken without dereferencing opinfo-&gt;o_fp, which a concurrent close may free. Select and pin the connection under ci-&gt;m_lock, the same lock session_fd_check() and ksmbd_reopen_durable_fd() use to update opinfo-&gt;conn, so a concurrent detach either loses the race to the clear or keeps the connection alive until the notification work releases it. Transfer the reference to the w…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-80926 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3321 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten oder den Systemzustand zu manipulieren, Denial-of-Service-Zustände herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten oder den Systemzustand zu manipulieren, Denial-of-Service-Zustände herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3321