Linux Kernel, sngrep, Tonec IDM Vulnerabilities Disclosed

A critical vulnerability in the Linux kernel's Network File System (NFS) server component could allow an attacker to cause a use-after-free condition, potentially leading to denial-of-service or privilege escalation. Multiple related flaws (CVE-2026-89708, CVE-2026-89703, CVE-2026-89702, CVE-2026-89689, CVE-2026-89688, CVE-2026-89686, CVE-2026-89681, CVE-2026-89677, CVE-2026-89676, CVE-2026-89675, CVE-2026-89660, CVE-2026-89659, CVE-2026-89658) have been patched, addressing issues in session teardown, stateid handling, delegation revocation, and asynchronous copy operations. These vulnerabilities stem from improper RCU protection, incorrect state management, and race conditions during various NFS operations, particularly affecting NFSv4. The fixes ensure that client sessions and stateids are properly managed to prevent memory corruption.

Multiple critical vulnerabilities have been identified in the Linux kernel's Ceph and SMB client implementations. For Ceph, a use-after-free vulnerability in check_new_map() (CVE-2026-89654) could be triggered when a session is freed during unlock, potentially leading to system instability. Another issue in handle_session() (CVE-2026-89651) involves improper decoding of session open messages, which could be exploited by an attacker. In the SMB client, an out-of-bounds read/write vulnerability exists in coalesce_t2() (CVE-2026-89633) due to unvalidated DataOffset fields in T2 responses. Additionally, a use-after-free and buffer leak in cifs_check_trans2() (CVE-2026-89637) can occur with malformed secondary T2 responses. The ksmbd component also has an issue (CVE-2026-89635) where it incorrectly rebinds oplocks during durable reconnects. These flaws highlight risks in handling network protocols and managing shared resources.

A critical stack buffer overflow vulnerability exists in sngrep (CVE-2026-90558) through version 1.8.4. This flaw arises from improper handling of SIP attribute formatting when header values exceed a 255-byte buffer limit. Attackers can exploit this by crafting malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields, potentially leading to denial-of-service or code execution. The vulnerability is particularly concerning for network infrastructure devices and services that rely on sngrep for SIP traffic analysis.

A high-severity vulnerability was found in Tonec Internet Download Manager (CVE-2026-90493) up to version 6.42 Build 63 on Windows. The issue resides in an unknown function within the idmwfp.sys kernel driver component, which could lead to improper access controls. This could potentially allow an attacker to gain elevated privileges or compromise system security. The exact impact and exploitability depend on the specific function affected, but kernel-level vulnerabilities often carry significant risk.