CVE-2026-31613
HighCVSS 8.1Summary
W jądrze systemu Linux naprawiono podatność związaną z odczytem poza granicami (OOB) podczas przetwarzania odpowiedzi błędu symlink. Problem występował, gdy serwer zwracał STATUS_STOPPED_ON_SYMLINK, co prowadziło do braku walidacji długości i potencjalnego odczytu danych poza przydzielonym obszarem pamięci.
Risk Assessment
Podatność ta może prowadzić do nieautoryzowanego dostępu do pamięci, co stwarza ryzyko wycieku danych lub wykonania złośliwego kodu w kontekście użytkownika. Organizacje powinny być świadome zagrożeń związanych z nieodpowiednią obsługą błędów w protokole SMB.
Recommendation
Zaleca się aktualizację jądra systemu Linux do najnowszej wersji, która zawiera poprawki dla tej podatności. Dodatkowo, warto monitorować i ograniczać dostęp do serwerów SMB, aby zminimalizować ryzyko związane z nieautoryzowanymi połączeniami.
Related vulnerabilities
- CVE-2026-87719Critical
GitLab EE versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 contain a vulnerability that, under certain conditions, allows an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials. Exploitation uses a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
- CVE-2026-85706CriticalActively exploited
GitLab CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 contain a vulnerability in the repository commits API caused by improper path confinement and missing authentication enforcement. Under certain conditions, an unauthenticated user could read arbitrary files from the GitLab server.
- CVE-2026-90456Critical
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.
- CVE-2026-53952Critical
GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.
- CVE-2026-79395Critical
The WS-Security (wsse:UsernameToken) verification routine in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier has an improper authentication vulnerability. A remote attacker can bypass authentication and execute privileged ONVIF actions (PTZ control, stream URL retrieval, system reboot) via a crafted SOAP request supplying the admin username with any arbitrary password when the account's stored password is empty.
- CVE-2026-62105Critical
Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.
- CVE-2026-62103Critical
Unauthenticated PHP Object Injection in Everest Forms versions 3.6.0 and below.
- CVE-2026-54072Critical
In Authorizer prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. With response_type=token or response_type=id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the client_id from the public /graphql endpoint.
- CVE-2026-82617Critical
The built-in name-finder patterns EMAIL and URL in Apache OpenNLP contain ambiguous nested quantifiers, enabling a ReDoS attack. A crafted input can trigger super-linear backtracking or unbounded matcher recursion, leading to CPU exhaustion or StackOverflowError. The issue affects versions 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5.
- CVE-2026-72710Critical
SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist. Attackers with a valid nonce can inject attacker-controlled rows into the spip_jobs table, and by supplying arg=job/0 with crafted fonction and args values, these are later unserialized and executed when the cron job queue is drained.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server. symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset 0. When the server-controlled ErrorDataLength advances p to within 1-7 bytes of end, the next iteration will read past it. When the matching context is found, sym->SymLinkErrorTag is read at offset 4 from p->ErrorContextData with no check that the symlink header itself fits. smb2_parse_symlink_response() then bounds-checks the substitute name using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from iov_base. That value is computed as sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), which is correct only when ErrorContextCount == 0. With at least one error context the symlink data sits 8 bytes deeper, and each skipped non-matching context shifts it further by 8 + ALIGN(ErrorDataLength, 8). The check is too short, allowing the substitute name read to run past iov_len. The out-of-bound heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2). Fix this all up by making the loops test require the full context header to fit, rejecting sym if its header runs past end, and bound the substitute name against the actual position of sym->PathBuffer rather than a fixed offset. Because sub_offs and sub_len are 16bits, the pointer math will not overflow here with the new greater-than.