https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 02:34:56 +0000 https://cve.radiocsirt.org/vuln/cve-2026-89634 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: fix ALIGN() overflow in symlink_data() error context loop</p> <p>The check added by commit 7d9a7f1f96cd (&#34;smb/client: fix possible infinite loop and oob read in symlink_data()&#34;) compared the post-ALIGN length against the remaining buffer, but ALIGN() itself can overflow: for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8) wraps to 0, so the subsequent bounds check passes, and the loop advances by zero bytes leaving &#39;p&#39; pointing into stale data.</p> <p>Fix by checking the raw ErrorDataLength against the remaining space before applying ALIGN(), then checking again after. Since raw_len is bounded by the buffer, raw_len + 7 cannot overflow, so the second check is an exact post-alignment bounds guard.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: fix ALIGN() overflow in symlink_data() error context loop</p> <p>The check added by commit 7d9a7f1f96cd (&#34;smb/client: fix possible infinite loop and oob read in symlink_data()&#34;) compared the post-ALIGN length against the remaining buffer, but ALIGN() itself can overflow: for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8) wraps to 0, so the subsequent bounds check passes, and the loop advances by zero bytes leaving &#39;p&#39; pointing into stale data.</p> <p>Fix by checking the raw ErrorDataLength against the remaining space before applying ALIGN(), then checking again after. Since raw_len is bounded by the buffer, raw_len + 7 cannot overflow, so the second check is an exact post-alignment bounds guard.</p> https://cve.radiocsirt.org/vuln/cve-2026-89634