CVE-2026-93489 - ASUS Router Improper Authentication Vulnerability
CVE ID :CVE-2026-93489
Published : Oct. 23, 2026, 8:16 a.m. | 36 minutes ago
Description :Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-93489
Published : Oct. 23, 2026, 8:16 a.m. | 36 minutes ago
Description :Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30043 - Missing Authentication in CGM CLININET
CVE ID :CVE-2025-30043
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. This issue was fixed in version 2026.MS3
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30043
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. This issue was fixed in version 2026.MS3
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30045 - Code Injection in CGM CLININET
CVE ID :CVE-2025-30045
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30045
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30046 - Remote Code Execution in CGM CLININET
CVE ID :CVE-2025-30046
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 9.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30046
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 9.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30047 - Remote Code Execution via Java Deserialization in CGM CLININET
CVE ID :CVE-2025-30047
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. This issue was fixed in version 2026.MS3
Severity: 9.4 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30047
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. This issue was fixed in version 2026.MS3
Severity: 9.4 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30049 - Use of Unsalted MD5 Password Hashes in CGM CLININET
CVE ID :CVE-2025-30049
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30049
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30050 - Remote Code Execution in CGM CLININET
CVE ID :CVE-2025-30050
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3
Severity: 9.4 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30050
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3
Severity: 9.4 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30051 - Insecure File Permissions in CGM CLININET
CVE ID :CVE-2025-30051
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS3
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30051
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS3
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30052 - Authentication Bypass via IP Spoofing in CGM CLININET rsyncd
CVE ID :CVE-2025-30052
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30052
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30053 - Missing Authentication in CGM CLININET
CVE ID :CVE-2025-30053
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30053
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-30054 - Local Privilege Escalation in CGM CLININET
CVE ID :CVE-2025-30054
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-30054
Published : Oct. 23, 2026, 8:22 a.m. | 30 minutes ago
Description :CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-58403 - Reflected Cross-Site Scripting (XSS) in CGM CLININET
CVE ID :CVE-2025-58403
Published : Oct. 23, 2026, 8:23 a.m. | 29 minutes ago
Description :CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2025-58403
Published : Oct. 23, 2026, 8:23 a.m. | 29 minutes ago
Description :CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-89312 - AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV
CVE ID :CVE-2026-89312
Published : Oct. 23, 2026, 8:36 a.m. | 16 minutes ago
Description :`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-89312
Published : Oct. 23, 2026, 8:36 a.m. | 16 minutes ago
Description :`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-89313 - JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
CVE ID :CVE-2026-89313
Published : Oct. 23, 2026, 8:40 a.m. | 12 minutes ago
Description :`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-89313
Published : Oct. 23, 2026, 8:40 a.m. | 12 minutes ago
Description :`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-98893 - firmware: arm_scmi: Validate SENSOR_UPDATE payload size
CVE ID :CVE-2026-98893
Published : Oct. 23, 2026, 11:37 a.m. | 34 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate SENSOR_UPDATE payload size SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not verify that the received payload contains those entries before parsing them. Reject truncated update notifications before reading the variable array.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-98893
Published : Oct. 23, 2026, 11:37 a.m. | 34 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate SENSOR_UPDATE payload size SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not verify that the received payload contains those entries before parsing them. Reject truncated update notifications before reading the variable array.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-98894 - drm/amd/ras: reset CPER ring on corrupt entry size
CVE ID :CVE-2026-98894
Published : Oct. 23, 2026, 11:37 a.m. | 34 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does not advance rptr after dword conversion and pointer masking. In that case the recovery loop keeps testing the same location while holding the CPER ring mutex. This can hang the worker that is writing the next CPER record. Detect a no-progress rptr update and reset the CPER ring to an empty state instead. This drops the corrupt contents and lets the writer leave the recovery path without spinning.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-98894
Published : Oct. 23, 2026, 11:37 a.m. | 34 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does not advance rptr after dword conversion and pointer masking. In that case the recovery loop keeps testing the same location while holding the CPER ring mutex. This can hang the worker that is writing the next CPER record. Detect a no-progress rptr update and reset the CPER ring to an empty state instead. This drops the corrupt contents and lets the writer leave the recovery path without spinning.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-98895 - net/mlx5: HWS, Handle destroying table that has a miss table
CVE ID :CVE-2026-98895
Published : Oct. 23, 2026, 11:37 a.m. | 34 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tbl keeps the table that points to it in a list. If such table is deleted, we need to also remove it from the miss_tbl list, otherwise the node in miss_tbl list will contain garbage.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-98895
Published : Oct. 23, 2026, 11:37 a.m. | 34 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tbl keeps the table that points to it in a list. If such table is deleted, we need to also remove it from the miss_tbl list, otherwise the node in miss_tbl list will contain garbage.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-98896 - thunderbolt: Keep the domain reference while processing hotplug
CVE ID :CVE-2026-98896
Published : Oct. 23, 2026, 11:37 a.m. | 34 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-98896
Published : Oct. 23, 2026, 11:37 a.m. | 34 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-112904 - Vvveb: Path Traversal in nextRestore() and nextBackup()
CVE ID :CVE-2026-112904
Published : Oct. 23, 2026, 11:45 a.m. | 26 minutes ago
Description :Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-112904
Published : Oct. 23, 2026, 11:45 a.m. | 26 minutes ago
Description :Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-98897 - ksmbd: don't hold ci->m_lock while waiting for a lease break ack
CVE ID :CVE-2026-98897
Published : Oct. 23, 2026, 11:54 a.m. | 18 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko client caches a read-handle (RH) lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in wait_for_break_ack() for up to OPLOCK_WAIT_TIME (35s). __smb_break_all_levII_oplock() runs that wait while holding ci->m_lock for read. cifs.ko reacts to a handle-lease break by closing the deferred handle rather than sending a lease break acknowledgment. That close path (close_id_del_oplock() -> opinfo_del()) takes ci->m_lock for write and is exactly what would wake the waiter, but it blocks on the read lock held by the waiting thread. The break is then resolved only by the 35s timeout, so xfstests generic/001 takes ~78s with leases enabled versus ~4s with oplocks only. Collect the target opinfos (each pinned with a reference) while holding ci->m_lock, then break them after releasing it, matching how smb_grant_oplock() already breaks a conflicting lease using only a reference. The reference keeps the opinfo (and its conn and lease) alive across the unlocked window, and a close racing the break is handled by the existing OPLOCK_CLOSING state check. Apply the same fix to the parent lease break paths.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-98897
Published : Oct. 23, 2026, 11:54 a.m. | 18 minutes ago
Description :In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko client caches a read-handle (RH) lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in wait_for_break_ack() for up to OPLOCK_WAIT_TIME (35s). __smb_break_all_levII_oplock() runs that wait while holding ci->m_lock for read. cifs.ko reacts to a handle-lease break by closing the deferred handle rather than sending a lease break acknowledgment. That close path (close_id_del_oplock() -> opinfo_del()) takes ci->m_lock for write and is exactly what would wake the waiter, but it blocks on the read lock held by the waiting thread. The break is then resolved only by the 35s timeout, so xfstests generic/001 takes ~78s with leases enabled versus ~4s with oplocks only. Collect the target opinfos (each pinned with a reference) while holding ci->m_lock, then break them after releasing it, matching how smb_grant_oplock() already breaks a conflicting lease using only a reference. The reference keeps the opinfo (and its conn and lease) alive across the unlocked window, and a close racing the break is handled by the existing OPLOCK_CLOSING state check. Apply the same fix to the parent lease break paths.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-115786 - Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
CVE ID :CVE-2026-115786
Published : Oct. 23, 2026, 2:17 p.m. | 35 minutes ago
Description :A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-115786
Published : Oct. 23, 2026, 2:17 p.m. | 35 minutes ago
Description :A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation deletes the record and reverses its folder counters without reversing the mailbox-wide charge. Repeated normal share notifications therefore accumulate quota usage after the visible records are gone. On accounts with a finite quota, this can prevent incoming mail and other size-increasing operations without recipient interaction. The issue affects ZCS 10.1.16 and 10.1.20.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...