Количество 16
Количество 16
CVE-2026-46155
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
CVE-2026-46155
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
CVE-2026-46155
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
CVE-2026-46155
smb/client: fix out-of-bounds read in smb2_compound_op()
CVE-2026-46155
In the Linux kernel, the following vulnerability has been resolved: s ...
GHSA-r5mc-mc43-5gch
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
BDU:2026-11326
Уязвимость функции smb2_compound_op() модуля fs/smb/client/smb2inode.c поддержки клиента SMB ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации
ROS-20260916-80-0071
Уязвимость kernel-lt
ELSA-2026-36541
ELSA-2026-36541: kernel security, bug fix, and enhancement update (IMPORTANT)
RLSA-2026:36018
Important: kernel security, bug fix, and enhancement update
ELSA-2026-36018
ELSA-2026-36018: kernel security, bug fix, and enhancement update (IMPORTANT)
ALT-PU-2026-8628
ALT-PU-2026-8628: package `kernel-image-6.18` update to version 6.18.34-alt1
ALT-PU-2026-9890
ALT-PU-2026-9890: package `kernel-image-rpi-un` update to version 6.12.94-alt1
ALT-PU-2026-9892
ALT-PU-2026-9892: package `kernel-image-6.12` update to version 6.12.94-alt1
ALT-PU-2026-11671
ALT-PU-2026-11671: package `kernel-image-rt` update to version 6.12.98-alt1
ALT-PU-2026-9924
ALT-PU-2026-9924: package `kernel-image-rpi-un` update to version 6.12.94-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-46155 In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory. | CVSS3: 9.1 | 1% Низкий | 5 месяцев назад |
 | CVE-2026-46155 In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory. | CVSS3: 7.1 | 1% Низкий | 5 месяцев назад |
 | CVE-2026-46155 In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory. | CVSS3: 9.1 | 1% Низкий | 5 месяцев назад |
 | CVE-2026-46155 smb/client: fix out-of-bounds read in smb2_compound_op() | CVSS3: 5.5 | 1% Низкий | 5 месяцев назад |
| CVE-2026-46155 In the Linux kernel, the following vulnerability has been resolved: s ... | CVSS3: 9.1 | 1% Низкий | 5 месяцев назад |
| GHSA-r5mc-mc43-5gch In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory. | CVSS3: 9.1 | 1% Низкий | 5 месяцев назад |
 | BDU:2026-11326 Уязвимость функции smb2_compound_op() модуля fs/smb/client/smb2inode.c поддержки клиента SMB ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации | CVSS3: 9.1 | 1% Низкий | 6 месяцев назад |
 | ROS-20260916-80-0071 Уязвимость kernel-lt | CVSS3: 9.1 | 1% Низкий | около 1 месяца назад |
| ELSA-2026-36541 ELSA-2026-36541: kernel security, bug fix, and enhancement update (IMPORTANT) | 3 месяца назад | ||
 | RLSA-2026:36018 Important: kernel security, bug fix, and enhancement update | 4 месяца назад | ||
| ELSA-2026-36018 ELSA-2026-36018: kernel security, bug fix, and enhancement update (IMPORTANT) | 4 месяца назад | ||
| ALT-PU-2026-8628 ALT-PU-2026-8628: package `kernel-image-6.18` update to version 6.18.34-alt1 | CVSS3: 10 | 5 месяцев назад | |
| ALT-PU-2026-9890 ALT-PU-2026-9890: package `kernel-image-rpi-un` update to version 6.12.94-alt1 | CVSS3: 10 | 4 месяца назад | |
| ALT-PU-2026-9892 ALT-PU-2026-9892: package `kernel-image-6.12` update to version 6.12.94-alt1 | CVSS3: 10 | 4 месяца назад | |
| ALT-PU-2026-11671 ALT-PU-2026-11671: package `kernel-image-rt` update to version 6.12.98-alt1 | CVSS3: 10 | 3 месяца назад | |
| ALT-PU-2026-9924 ALT-PU-2026-9924: package `kernel-image-rpi-un` update to version 6.12.94-alt1 | CVSS3: 10 | 4 месяца назад |
Уязвимостей на страницу