CVE-2026-64448 (GCVE-0-2026-64448)
Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-10-19 20:38
VLAI
EPSS
VEX
Title
smb: client: restrict implied bcc[0] exemption to responses without data area
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: restrict implied bcc[0] exemption to responses without data area
smb2_check_message() has a long-standing quirk that accepts a response
whose calculated length is one byte larger than the bytes actually
received ("server can return one byte more due to implied bcc[0]").
This was introduced to accommodate servers that omit the trailing bcc[0]
overlap byte when no data area is present.
However, the exemption is applied unconditionally, regardless of whether
the command actually carries a data area (has_smb2_data_area[]). When a
response with a data area is subject to the +1 exemption, the reported
data can extend one byte beyond the bytes actually received, yet
smb2_check_message() still accepts it. The subsequent decoder then reads
past the end of the receive buffer. This is reachable during NEGOTIATE
and SESSION_SETUP, before the session is established.
The resulting out-of-bounds reads are visible under KASAN when mounting
against a non-conforming server; both the SPNEGO/negTokenInit and the
NTLMSSP challenge decoders are affected:
BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00
Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81
CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1
Call Trace:
<TASK>
dump_stack_lvl+0x4e/0x70
print_report+0x157/0x4c9
kasan_report+0xce/0x100
asn1_ber_decoder+0x16a7/0x1b00
decode_negTokenInit+0x19/0x30
SMB2_negotiate+0x31d9/0x4c90
cifs_negotiate_protocol+0x1f2/0x3f0
cifs_get_smb_ses+0x93f/0x17e0
cifs_mount_get_session+0x7f/0x3a0
cifs_mount+0xb4/0xcf0
cifs_smb3_do_mount+0x23a/0x1500
smb3_get_tree+0x3b0/0x630
vfs_get_tree+0x82/0x2d0
fc_mount+0x10/0x1b0
path_mount+0x50d/0x1de0
__x64_sys_mount+0x20b/0x270
do_syscall_64+0xee/0x590
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 85:
kmem_cache_alloc_noprof+0x106/0x380
mempool_alloc_noprof+0x116/0x1e0
cifs_small_buf_get+0x31/0x80
allocate_buffers+0x10d/0x2b0
cifs_demultiplex_thread+0x1d5/0x1d50
kthread+0x2c6/0x390
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
The buggy address is located 0 bytes to the right of
allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)
which belongs to the cache cifs_small_rq of size 448
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50
Read of size 329 at addr ffff88800726c678 by task mount.cifs/89
CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1
Call Trace:
<TASK>
dump_stack_lvl+0x4e/0x70
print_report+0x157/0x4c9
kasan_report+0xce/0x100
kasan_check_range+0x10f/0x1e0
__asan_memcpy+0x23/0x60
kmemdup_noprof+0x36/0x50
decode_ntlmssp_challenge+0x457/0x680
SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0
SMB2_sess_setup+0x219/0x4f0
cifs_setup_session+0x248/0xaf0
cifs_get_smb_ses+0xf79/0x17e0
cifs_mount_get_session+0x7f/0x3a0
cifs_mount+0xb4/0xcf0
cifs_smb3_do_mount+0x23a/0x1500
smb3_get_tree+0x3b0/0x630
vfs_get_tree+0x82/0x2d0
fc_mount+0x10/0x1b0
path_mount+0x50d/0x1de0
__x64_sys_mount+0x20b/0x270
do_syscall_64+0xee/0x590
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 93:
kmem_cache_alloc_noprof+0x106/0x380
mempool_alloc_noprof+0x116/0x1e0
cifs_small_buf_get+0x31/0x80
allocate_buffers+0x10d/0x2b0
cifs_demultiplex_thread+0x1d5/0x1d50
kthread+0x2c6/0x390
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
The buggy address is located 120 bytes inside of
allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)
which belongs to the cache cifs_small_rq of size 448
Restrict the +1 exemption to responses that have no data area, so that
it still covers the bcc[0] omission it was meant for. When a data area
is present, the +1 discrepancy instead means the reported data length
overruns the
---truncated---
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:41 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
093b2bdad3221e3fae3c26d89387e7297a157664 , < 8d0bbc78046d264bbf6a574ea6f9072258a43e35
(git)
Affected: 093b2bdad3221e3fae3c26d89387e7297a157664 , < b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0 (git) Affected: 093b2bdad3221e3fae3c26d89387e7297a157664 , < 31c6312608c60b72a1feb99a5afb680645a3e8a3 (git) Affected: 093b2bdad3221e3fae3c26d89387e7297a157664 , < 573e502d14714d2947e22e7eff40ec20a6a44a42 (git) Affected: 093b2bdad3221e3fae3c26d89387e7297a157664 , < 419ec1b604d7fb60c10aec2dc062371f9fcd4940 (git) Affected: 093b2bdad3221e3fae3c26d89387e7297a157664 , < ceb875a375dedbf51c9425c1d13a2d7a8435c08c (git) Affected: 093b2bdad3221e3fae3c26d89387e7297a157664 , < 6e9d10f62773b99bd927940fd9cbdfe7207e23ff (git) Affected: 093b2bdad3221e3fae3c26d89387e7297a157664 , < 53b7c271f06be4dd5cfc8c6ef552a8355c891a7f (git) |
guessed | |
| Linux | Linux |
Affected:
3.6
Unaffected: 0 , < 3.6 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:41:01.162608Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:30.137Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d0bbc78046d264bbf6a574ea6f9072258a43e35",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "31c6312608c60b72a1feb99a5afb680645a3e8a3",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "573e502d14714d2947e22e7eff40ec20a6a44a42",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "419ec1b604d7fb60c10aec2dc062371f9fcd4940",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "ceb875a375dedbf51c9425c1d13a2d7a8435c08c",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "6e9d10f62773b99bd927940fd9cbdfe7207e23ff",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "53b7c271f06be4dd5cfc8c6ef552a8355c891a7f",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: restrict implied bcc[0] exemption to responses without data area\n\nsmb2_check_message() has a long-standing quirk that accepts a response\nwhose calculated length is one byte larger than the bytes actually\nreceived (\"server can return one byte more due to implied bcc[0]\").\nThis was introduced to accommodate servers that omit the trailing bcc[0]\noverlap byte when no data area is present.\n\nHowever, the exemption is applied unconditionally, regardless of whether\nthe command actually carries a data area (has_smb2_data_area[]). When a\nresponse with a data area is subject to the +1 exemption, the reported\ndata can extend one byte beyond the bytes actually received, yet\nsmb2_check_message() still accepts it. The subsequent decoder then reads\npast the end of the receive buffer. This is reachable during NEGOTIATE\nand SESSION_SETUP, before the session is established.\n\nThe resulting out-of-bounds reads are visible under KASAN when mounting\nagainst a non-conforming server; both the SPNEGO/negTokenInit and the\nNTLMSSP challenge decoders are affected:\n\n BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00\n Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81\n CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n asn1_ber_decoder+0x16a7/0x1b00\n decode_negTokenInit+0x19/0x30\n SMB2_negotiate+0x31d9/0x4c90\n cifs_negotiate_protocol+0x1f2/0x3f0\n cifs_get_smb_ses+0x93f/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n Allocated by task 85:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 0 bytes to the right of\n allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)\n which belongs to the cache cifs_small_rq of size 448\n\n BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50\n Read of size 329 at addr ffff88800726c678 by task mount.cifs/89\n CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n kasan_check_range+0x10f/0x1e0\n __asan_memcpy+0x23/0x60\n kmemdup_noprof+0x36/0x50\n decode_ntlmssp_challenge+0x457/0x680\n SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0\n SMB2_sess_setup+0x219/0x4f0\n cifs_setup_session+0x248/0xaf0\n cifs_get_smb_ses+0xf79/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n Allocated by task 93:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 120 bytes inside of\n allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)\n which belongs to the cache cifs_small_rq of size 448\n\nRestrict the +1 exemption to responses that have no data area, so that\nit still covers the bcc[0] omission it was meant for. When a data area\nis present, the +1 discrepancy instead means the reported data length\noverruns the\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised SMB server can trigger the flaw through crafted TCP responses, typically over port 445.\nAC:L - The server directly controls the frame length, data offset, and declared data length, so no race or condition outside the attacker\u0027s control is required.\nPR:N - NEGOTIATE and SESSION_SETUP responses are processed before authentication and signature verification, requiring no attacker credentials or local capabilities.\nUI:N - An existing persistent SMB mount automatically renegotiates after a server-induced reconnect, allowing exploitation without contemporaneous user action.\nS:U - The vulnerable SMB decoder and resulting kernel impact remain within the host kernel\u0027s security authority.\nC:L - The discrepancy permits exactly one byte beyond the received data to be read; the NTLM path can preserve and reflect that byte in subsequent authentication data, but the disclosure is strictly bounded.\nI:N - The flaw performs an out-of-bounds read and copies data into valid allocations; it provides no out-of-bounds write or other demonstrated memory-modification primitive.\nA:H - The demonstrated slab out-of-bounds access raises a KASAN BUG and can panic hardened kernels, and a malicious peer can retrigger it during negotiation or reconnection."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:51.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35"
},
{
"url": "https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0"
},
{
"url": "https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3"
},
{
"url": "https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42"
},
{
"url": "https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940"
},
{
"url": "https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c"
},
{
"url": "https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff"
},
{
"url": "https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f"
}
],
"title": "smb: client: restrict implied bcc[0] exemption to responses without data area",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64448",
"datePublished": "2026-07-25T08:51:18.796Z",
"dateReserved": "2026-07-19T15:36:31.788Z",
"dateUpdated": "2026-10-19T20:38:30.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-64448",
"date": "2026-11-11",
"epss": "0.00463",
"percentile": "0.40566"
},
"microsoft_vex": {
"current_release_date": "2026-07-27T14:49:08.000Z",
"cve": "CVE-2026-64448",
"id": "msrc_CVE-2026-64448",
"initial_release_date": "2026-07-26T01:06:59.000Z",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "smb: client: restrict implied bcc[0] exemption to responses without data area",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64448.json",
"version": "2"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d0bbc78046d264bbf6a574ea6f9072258a43e35",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "31c6312608c60b72a1feb99a5afb680645a3e8a3",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "573e502d14714d2947e22e7eff40ec20a6a44a42",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "419ec1b604d7fb60c10aec2dc062371f9fcd4940",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "ceb875a375dedbf51c9425c1d13a2d7a8435c08c",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "6e9d10f62773b99bd927940fd9cbdfe7207e23ff",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "53b7c271f06be4dd5cfc8c6ef552a8355c891a7f",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C5143C8B-0B5A-4B4A-9FBF-0393CD1FE05B",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: restrict implied bcc[0] exemption to responses without data area\n\nsmb2_check_message() has a long-standing quirk that accepts a response\nwhose calculated length is one byte larger than the bytes actually\nreceived (\"server can return one byte more due to implied bcc[0]\").\nThis was introduced to accommodate servers that omit the trailing bcc[0]\noverlap byte when no data area is present.\n\nHowever, the exemption is applied unconditionally, regardless of whether\nthe command actually carries a data area (has_smb2_data_area[]). When a\nresponse with a data area is subject to the +1 exemption, the reported\ndata can extend one byte beyond the bytes actually received, yet\nsmb2_check_message() still accepts it. The subsequent decoder then reads\npast the end of the receive buffer. This is reachable during NEGOTIATE\nand SESSION_SETUP, before the session is established.\n\nThe resulting out-of-bounds reads are visible under KASAN when mounting\nagainst a non-conforming server; both the SPNEGO/negTokenInit and the\nNTLMSSP challenge decoders are affected:\n\n BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00\n Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81\n CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n asn1_ber_decoder+0x16a7/0x1b00\n decode_negTokenInit+0x19/0x30\n SMB2_negotiate+0x31d9/0x4c90\n cifs_negotiate_protocol+0x1f2/0x3f0\n cifs_get_smb_ses+0x93f/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n Allocated by task 85:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 0 bytes to the right of\n allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)\n which belongs to the cache cifs_small_rq of size 448\n\n BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50\n Read of size 329 at addr ffff88800726c678 by task mount.cifs/89\n CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n kasan_check_range+0x10f/0x1e0\n __asan_memcpy+0x23/0x60\n kmemdup_noprof+0x36/0x50\n decode_ntlmssp_challenge+0x457/0x680\n SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0\n SMB2_sess_setup+0x219/0x4f0\n cifs_setup_session+0x248/0xaf0\n cifs_get_smb_ses+0xf79/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n Allocated by task 93:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 120 bytes inside of\n allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)\n which belongs to the cache cifs_small_rq of size 448\n\nRestrict the +1 exemption to responses that have no data area, so that\nit still covers the bcc[0] omission it was meant for. When a data area\nis present, the +1 discrepancy instead means the reported data length\noverruns the\n---truncated---"
}
],
"id": "CVE-2026-64448",
"lastModified": "2026-10-19T21:17:39.457",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-64448",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:41:01.162608Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-25T10:17:29.557",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T04:36:16+00:00",
"cve": "CVE-2026-64448",
"id": "CVE-2026-64448",
"initial_release_date": "2026-07-25T00:00:00+00:00",
"product_status:known_affected": "158",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: smb: client: restrict implied bcc[0] exemption to responses without data area",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64448.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:41:01.162608Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:41:02.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d0bbc78046d264bbf6a574ea6f9072258a43e35",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "31c6312608c60b72a1feb99a5afb680645a3e8a3",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "573e502d14714d2947e22e7eff40ec20a6a44a42",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "419ec1b604d7fb60c10aec2dc062371f9fcd4940",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "ceb875a375dedbf51c9425c1d13a2d7a8435c08c",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "6e9d10f62773b99bd927940fd9cbdfe7207e23ff",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
},
{
"lessThan": "53b7c271f06be4dd5cfc8c6ef552a8355c891a7f",
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: restrict implied bcc[0] exemption to responses without data area\n\nsmb2_check_message() has a long-standing quirk that accepts a response\nwhose calculated length is one byte larger than the bytes actually\nreceived (\"server can return one byte more due to implied bcc[0]\").\nThis was introduced to accommodate servers that omit the trailing bcc[0]\noverlap byte when no data area is present.\n\nHowever, the exemption is applied unconditionally, regardless of whether\nthe command actually carries a data area (has_smb2_data_area[]). When a\nresponse with a data area is subject to the +1 exemption, the reported\ndata can extend one byte beyond the bytes actually received, yet\nsmb2_check_message() still accepts it. The subsequent decoder then reads\npast the end of the receive buffer. This is reachable during NEGOTIATE\nand SESSION_SETUP, before the session is established.\n\nThe resulting out-of-bounds reads are visible under KASAN when mounting\nagainst a non-conforming server; both the SPNEGO/negTokenInit and the\nNTLMSSP challenge decoders are affected:\n\n BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00\n Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81\n CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n asn1_ber_decoder+0x16a7/0x1b00\n decode_negTokenInit+0x19/0x30\n SMB2_negotiate+0x31d9/0x4c90\n cifs_negotiate_protocol+0x1f2/0x3f0\n cifs_get_smb_ses+0x93f/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n Allocated by task 85:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 0 bytes to the right of\n allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)\n which belongs to the cache cifs_small_rq of size 448\n\n BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50\n Read of size 329 at addr ffff88800726c678 by task mount.cifs/89\n CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n kasan_check_range+0x10f/0x1e0\n __asan_memcpy+0x23/0x60\n kmemdup_noprof+0x36/0x50\n decode_ntlmssp_challenge+0x457/0x680\n SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0\n SMB2_sess_setup+0x219/0x4f0\n cifs_setup_session+0x248/0xaf0\n cifs_get_smb_ses+0xf79/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n Allocated by task 93:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 120 bytes inside of\n allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)\n which belongs to the cache cifs_small_rq of size 448\n\nRestrict the +1 exemption to responses that have no data area, so that\nit still covers the bcc[0] omission it was meant for. When a data area\nis present, the +1 discrepancy instead means the reported data length\noverruns the\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised SMB server can trigger the flaw through crafted TCP responses, typically over port 445.\nAC:L - The server directly controls the frame length, data offset, and declared data length, so no race or condition outside the attacker\u0027s control is required.\nPR:N - NEGOTIATE and SESSION_SETUP responses are processed before authentication and signature verification, requiring no attacker credentials or local capabilities.\nUI:N - An existing persistent SMB mount automatically renegotiates after a server-induced reconnect, allowing exploitation without contemporaneous user action.\nS:U - The vulnerable SMB decoder and resulting kernel impact remain within the host kernel\u0027s security authority.\nC:L - The discrepancy permits exactly one byte beyond the received data to be read; the NTLM path can preserve and reflect that byte in subsequent authentication data, but the disclosure is strictly bounded.\nI:N - The flaw performs an out-of-bounds read and copies data into valid allocations; it provides no out-of-bounds write or other demonstrated memory-modification primitive.\nA:H - The demonstrated slab out-of-bounds access raises a KASAN BUG and can panic hardened kernels, and a malicious peer can retrigger it during negotiation or reconnection."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:51.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35"
},
{
"url": "https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0"
},
{
"url": "https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3"
},
{
"url": "https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42"
},
{
"url": "https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940"
},
{
"url": "https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c"
},
{
"url": "https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff"
},
{
"url": "https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f"
}
],
"title": "smb: client: restrict implied bcc[0] exemption to responses without data area",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64448",
"datePublished": "2026-07-25T08:51:18.796Z",
"dateReserved": "2026-07-19T15:36:31.788Z",
"dateUpdated": "2026-10-19T20:38:30.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.