https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 11:27:29 +0000 https://vulnerability.circl.lu/vuln/bell-cve-2026-64392 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://vulnerability.circl.lu/vuln/bell-cve-2026-64392 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1031 certfr-2026-avi-1031 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1031 https://vulnerability.circl.lu/vuln/fkie_cve-2026-64392 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: use opener credentials for delete-on-close</p> <p>Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks.</p> <p>Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user&#39;s fsuid, fsgid, supplementary groups and capability restrictions at final close.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: use opener credentials for delete-on-close</p> <p>Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks.</p> <p>Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user&#39;s fsuid, fsgid, supplementary groups and capability restrictions at final close.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-64392 https://vulnerability.circl.lu/vuln/ghsa-cq4q-mqm3-8r2p <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: use opener credentials for delete-on-close</p> <p>Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks.</p> <p>Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user&#39;s fsuid, fsgid, supplementary groups and capability restrictions at final close.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: use opener credentials for delete-on-close</p> <p>Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks.</p> <p>Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user&#39;s fsuid, fsgid, supplementary groups and capability restrictions at final close.</p> https://vulnerability.circl.lu/vuln/ghsa-cq4q-mqm3-8r2p https://vulnerability.circl.lu/vuln/msrc_cve-2026-64392 msrc_CVE-2026-64392 https://vulnerability.circl.lu/vuln/msrc_cve-2026-64392 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11476-1 <p>kernel-devel-7.1.7-1.1 on GA media</p> <p>kernel-devel-7.1.7-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11476-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-64392 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 193 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks. Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user&#39;s fsuid, fsgid, supplementary groups and capability restrictions at final close.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 193 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks. Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user&#39;s fsuid, fsgid, supplementary groups and capability restrictions at final close.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-64392 https://vulnerability.circl.lu/vuln/wid-sec-w-2026-2527 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, dazu können DoS-Angriffe, die Offenlegung von Informationen, die Beschädigung des Speichers oder die Umgehung von Sicherheitsmaßnahmen gehören.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, dazu können DoS-Angriffe, die Offenlegung von Informationen, die Beschädigung des Speichers oder die Umgehung von Sicherheitsmaßnahmen gehören.</p> https://vulnerability.circl.lu/vuln/wid-sec-w-2026-2527