huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-42766: openssl: Possible NULL Dereference in Password-Based CMS Decryption
Component: openssl
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. A remote attacker could exploit a NULL pointer dereference vulnerability in the Cryptographic Message Syntax (CMS) decryption process by providing a specially crafted password-encrypted CMS message. This occurs because the keyDerivationAlgorithm field, which is optional, is dereferenced without proper validation. Successful exploitation leads to an application crash, resulting in a Denial of Service.

Statement: This issue is rated as Low impact. A NULL pointer dereference in OpenSSL's CMS decryption can be triggered by a specially crafted password-encrypted CMS message, leading to an Red Hat application crash and Denial of Service. This affects applications that perform password-based CMS decryption.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21, 1.1.1 < 1.1.1zh, 1.0.2 < 1.0.2zq
Fixed upstream versions: 1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 12bc26ffb3a2be728c9b86e1cae277de5b33dfa4
CVE-2026-42767: openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption
Component: openssl
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. An attacker controlling a Certificate Management Protocol (CMP) server, or acting as a man-in-the-middle, could craft a malicious CMP response. This response, containing a Certificate Request Message Format (CRMF) CertRepMessage with a specific malformed EncryptedValue structure, would trigger a NULL pointer dereference in the OpenSSL CMP client. This vulnerability leads to a crash of the application, resulting in a Denial of Service (DoS).

Statement: This is a Low severity issue. A null pointer dereference flaw in the OpenSSL Certificate Management Protocol (CMP) client could be triggered by an attacker-controlled CMP server. This could lead to a denial of service in applications that process untrusted CMP/CRMF messages.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21
Fixed upstream versions: 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: b90ff3b1bd33b1c18e6a09936d097c2eddef8873
CVE-2026-42768: openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
Component: openssl
Severity: Low
CWE: CWE-205 (Observable Behavioral Discrepancy)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL's CMS_decrypt() and PKCS7_decrypt() functions. This vulnerability, a Bleichenbacher-style oracle, could allow a remote attacker to decrypt or sign messages using the victim's private RSA key. Exploitation requires the attacker to provide specially crafted CMS or S/MIME messages and observe the application's error codes or decryption output. While the attack is technically possible, the specific conditions required make it unlikely to be exploited in typical deployments.

Statement: This Low severity vulnerability in OpenSSL's CMS_decrypt() and PKCS7_decrypt() functions exposes a Bleichenbacher-style oracle. Exploitation requires an attacker to control input CMS/S/MIME messages and observe decryption errors or output, a scenario deemed unlikely in most Red Hat product deployments. The attack could allow decryption or signing of messages with a victim's private RSA key.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6
Fixed upstream versions: 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: f04b377be3d821741c86d1f4bf84dee09f3d5c3e
CVE-2026-42769: openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate
Component: openssl
Severity: Low
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in the Certificate Management Protocol (CMP) implementation within OpenSSL. An attacker with existing Registration Authority (RA) level credentials could exploit an error in the certificate verification process during a Root Certificate Authority (CA) key update. This vulnerability allows the attacker to replace the root CA certificate for CMP clients with a fraudulent one. The primary consequence is an escalation of privileges, enabling the attacker to gain control equivalent to the root CA.

Statement: This issue has a Low impact as it requires an attacker to already possess valid Registration Authority (RA) level credentials to exploit. A flaw in the Certificate Management Protocol (CMP) root CA key update process could allow an RA to substitute the root CA certificate for CMP clients with an arbitrary certificate, potentially leading to a trust-anchor substitution. FIPS modules are not affected.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6
Fixed upstream versions: 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: d531f21c0fe99067a66fc0ff1161ef127f9cd70b
CVE-2026-42770: openssl: FFC-DH Peer Validation Uses Attacker-Supplied q
Component: openssl
Severity: Low
CWE: CWE-354 (Improper Validation of Integrity Check Value)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. A malicious peer can exploit this vulnerability by presenting a specially crafted DHX (X9.42) peer key. Due to improper validation of the peer key's subgroup membership, an attacker can recover the victim's private key after a small number of key exchange attempts. This information disclosure can lead to unauthorized access or further compromise of affected systems.

Statement: This Low severity flaw in OpenSSL affects systems configured to use DHX (X9.42) peer keys for key derivation, allowing a malicious peer to potentially recover a victim's private key. The attack requires specific conditions, such as long-lived RA/CA DHX keys in CMP deployments or bespoke applications utilizing X9.42 DHX static keys with interactive protocols, limiting its broader impact.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21
Fixed upstream versions: 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 3da5a516cd2635a320ff748503db2cef7c4b0f02
CVE-2026-42789: erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation
Component: erlang
Severity: Important
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)
Public date: 2026-05-27T12:23:06.355000+00:00

A flaw was found in Erlang OTP's public_key module. This vulnerability (CWE-295), related to improper certificate validation, allows a non-Certificate Authority (CA) certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can exploit this by forging leaf certificates for arbitrary identities. This can lead to compromised server identity verification on the client side and client certificate verification on mutual Transport Layer Security (mTLS) servers, undermining the trust in certificate-based authentication.

Statement: This is an Important vulnerability where Erlang OTP's `public_key` module improperly validates certificate chains. A remote attacker with an existing end-entity certificate from a trusted Certificate Authority can forge new leaf certificates, leading to compromised server or client identity verification in TLS/mTLS connections. This impacts applications within Red Hat OpenStack Platform and Community Projects that utilize the default verifier in the OTP `ssl` application. Because an attacker must be able to create or locate a certificate with specific attributes, Red Hat assesses the impact of this vulnerability as Important.

Affected upstream versions: 0.22 < *, 17.0 < *
Fixed upstream versions: OTP-26.2.5.21
Upstream repository: https://github.com/erlang/otp
Upstream fix commit: 471cd2f664300a95353c467873800bbe706005db
CVE-2026-42790: erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing
Component: erlang
Severity: Important
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-05-27T15:09:01.860000+00:00

A flaw was found in Erlang OTP public_key. This improper certificate validation vulnerability allows a subordinate Certificate Authority (CA) with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name (SAN) but contains a crafted CommonName (CN), an attacker can trick an Erlang OTP TLS client into accepting it as valid for an out-of-scope hostname. This can lead to hostname spoofing and potential man-in-the-middle attacks, compromising the integrity and confidentiality of communications.

Statement: This Important flaw in Erlang OTP's public_key module allows a subordinate Certificate Authority to bypass DNS name constraints during TLS hostname verification. An attacker could exploit this by issuing a specially crafted certificate lacking a Subject Alternative Name but containing a malicious CommonName, enabling hostname spoofing and potential man-in-the-middle attacks against Red Hat products acting as Erlang OTP TLS clients.

Affected upstream versions: 1.4 < *, 19.3 < *
Fixed upstream versions: OTP-26.2.5.21
Upstream repository: https://github.com/erlang/otp
Upstream fix commit: 0769050c69d73762672b0db1347b6993a5b31759
CVE-2026-43006: kernel: io_uring/rsrc: reject zero-length fixed buffer import
Component: kernel
Severity: Moderate
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's io_uring subsystem. A local attacker can exploit a vulnerability in the `io_import_fixed()` function by importing a zero-length fixed buffer. This can lead to an out-of-bounds read from slab memory, potentially resulting in information disclosure or a denial of service.


Affected upstream versions: 6.15
Fixed upstream versions: 0, 6.18.22, 6.19.12, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 040a1e7e0e2f01851fec1dd2d96906f8636a9f75
CVE-2026-43020: kernel: Bluetooth: MGMT: validate LTK enc_size on load
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth management (MGMT) component. An attacker could exploit a vulnerability in how Long Term Keys (LTK) are loaded. By providing an oversized encryption size, a stack buffer overflow can occur, potentially leading to a denial of service.


Affected upstream versions: 3.4
Fixed upstream versions: 0, 5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f37d1e65c6d71ad94ccfb5c602163c525db789d
CVE-2026-43023: kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect()
Component: kernel
Severity: Moderate
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within its Bluetooth Synchronous Connection-Oriented (SCO) component. This vulnerability occurs due to race conditions when multiple connection attempts are made simultaneously on the same Bluetooth socket. This can lead to a use-after-free error, where the system attempts to use memory that has already been released. Exploitation of this flaw could result in system instability, causing the system to crash or become unresponsive, and potentially lead to a denial of service.


Affected upstream versions: 6.1.109 < 6.1.168, 6.3
Fixed upstream versions: 0, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dabf22269242e2f2bf44c43fcdc2fa763df7f9cc
CVE-2026-43027: kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the `nf_conntrack_helper`. When a connection tracking helper is unregistered, its associated expectations are not properly cleaned up. This oversight can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. A local attacker could exploit this to cause a system crash, resulting in a Denial of Service (DoS), or potentially achieve privilege escalation.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5cf28d5c8dcbbe8af6d3b145babe491906d7bad1
CVE-2026-43037: kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
Component: kernel
Severity: Critical
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's IPv6 tunnel implementation. A remote attacker could exploit this flaw by sending malicious ICMPv6 error messages to cause a stack-based buffer overflow in the kernel's IPv4-over-IPv6 tunnel error handling code. This could result in a kernel crash (denial of service) or potentially allow arbitrary code execution with kernel privileges.

Statement: This Critical flaw in the Linux kernel's IPv6 tunneling error handling can lead to a stack buffer overflow. An unauthenticated remote attacker could exploit this by sending specially crafted network packets, potentially resulting in a denial of service or information disclosure on affected Red Hat Enterprise Linux systems.

Affected upstream versions: 2.6.22
Fixed upstream versions: 0, 5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ea9f65b27c8404e164848ebff1443310fd187629
CVE-2026-43038: kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
Component: kernel
Severity: Important
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option (CIPSO) IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 ICMP error, potentially causing an out-of-bounds memory access. This memory corruption could result in information disclosure or a denial of service.


Affected upstream versions: 3.13
Fixed upstream versions: 0, 5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c438ba010171b70bad22fc18b1d5bdc3627476e8
CVE-2026-43051: kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's Wacom Human Interface Device (HID) driver. This vulnerability allows a remote attacker to trigger an out-of-bounds read by sending a specially crafted, short Bluetooth HID report. This can lead to the disclosure of sensitive information from the system's memory.

Statement: A Bluetooth HID report parsing bug in the Wacom driver can cause an out of bounds read in wacom_intuos_bt_irq. Report 0x03 needs at least 22 bytes and report 0x04 needs 32 bytes because it falls through into the 0x03 handling path, but the old code processed shorter reports without validating these lengths. A malicious or compromised Bluetooth HID device can send a crafted short report and make the kernel read past the received report buffer while updating Wacom input or battery state. For the CVSS the PR:N is used in the paranoid score because the attacker only needs Bluetooth device control and does not need a local account on the victim. The issue is adjacent network reachable over Bluetooth rather than Internet reachable.

Affected upstream versions: 3.3
Fixed upstream versions: 0, 5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada
CVE-2026-43056: kernel: net: mana: fix use-after-free in add_adev() error path
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's mana network driver. An issue in the error handling of the `add_adev()` function can lead to a use-after-free vulnerability. This occurs when memory is released prematurely but then accessed again, which could allow a local attacker to cause a system crash (denial of service) or potentially gain elevated access (privilege escalation).


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d88541ffd56d62a61e77209080001eddd4d69815
CVE-2026-43074: kernel: eventpoll: defer struct eventpoll free to RCU grace period
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's `eventpoll` component. In certain situations, the `ep_free()` function in `eventpoll.c` can prematurely free the `eventpoll` data structure while it is still being used by another concurrent thread. This use-after-free (UAF) vulnerability could allow a local attacker to cause a denial of service or potentially escalate privileges.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 902120be4f44947df6311002addc7faf69bdbff1
CVE-2026-43077: kernel: crypto: algif_aead - Fix minimum RX size check for decryption
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within the `algif_aead` module. The vulnerability involves an incorrect check for the minimum receive buffer size during decryption, which did not properly account for the tag size. This could potentially lead to issues with data integrity or processing during cryptographic decryption operations.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.254, 5.15.204, 6.1.170, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 74a66fdb5282d89e348b00c42cfca3a936946d94
CVE-2026-43110: kernel: wifi: brcmfmac: validate bsscfg indices in IF events
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. This vulnerability occurs because the driver fails to properly validate bsscfg indices in interface (IF) events. An attacker could exploit this by sending a specially crafted IF event with an invalid bsscfg index, which could lead to an out-of-bounds write or read, potentially causing a system crash and resulting in a denial of service (DoS).

Statement: brcmfmac IF event handling validates the firmware provided ifidx but still uses the raw bsscfgidx value as an index into the driver iflist array. A malformed firmware IF event with an out of range bsscfgidx can cause an out of bounds pointer read and may lead to an invalid pointer dereference or broader memory corruption depending on how the resulting ifp is used. For the CVSS the PR:N is used in the paranoid score because a practical attacker model may involve adjacent Wi-Fi influence over FullMAC firmware events rather than a local privileged user on the host. The issue is not reachable over a normal routed IP network. It is adjacent network or device firmware mediated. Impact is at least denial of service through a kernel crash or Wi-Fi driver failure. In the paranoid case, the unchecked firmware controlled array index potentially could lead to possible confidentiality and integrity impact (but primarily only Availability impact).

Affected upstream versions: 3.9
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b329fbcf075949a038045d8e9b86ae3d5bbd8a54
CVE-2026-43112: kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
Component: kernel
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.

Statement: An Important out-of-bounds read flaw in the Linux kernel's CIFS client can lead to a system crash and denial of service. This vulnerability, present in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 2, can be triggered by processing specially crafted input to the `cifs_sanitize_prepath` function, potentially disrupting system availability.

Affected upstream versions: 5.15.11 < 5.15.209, 5.16
Fixed upstream versions: 0, 5.15.209, 6.1.175, 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a2ba20c17de8eb028f96b1d85f119d3d25655bd9