{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64448","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T15:36:31.788Z","datePublished":"2026-07-25T08:51:18.796Z","dateUpdated":"2026-08-17T04:55:51.813Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T04:55:51.813Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: restrict implied bcc[0] exemption to responses without data area\n\nsmb2_check_message() has a long-standing quirk that accepts a response\nwhose calculated length is one byte larger than the bytes actually\nreceived (\"server can return one byte more due to implied bcc[0]\").\nThis was introduced to accommodate servers that omit the trailing bcc[0]\noverlap byte when no data area is present.\n\nHowever, the exemption is applied unconditionally, regardless of whether\nthe command actually carries a data area (has_smb2_data_area[]). When a\nresponse with a data area is subject to the +1 exemption, the reported\ndata can extend one byte beyond the bytes actually received, yet\nsmb2_check_message() still accepts it. The subsequent decoder then reads\npast the end of the receive buffer. This is reachable during NEGOTIATE\nand SESSION_SETUP, before the session is established.\n\nThe resulting out-of-bounds reads are visible under KASAN when mounting\nagainst a non-conforming server; both the SPNEGO/negTokenInit and the\nNTLMSSP challenge decoders are affected:\n\n BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00\n Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81\n CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1\n Call Trace:\n \n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n asn1_ber_decoder+0x16a7/0x1b00\n decode_negTokenInit+0x19/0x30\n SMB2_negotiate+0x31d9/0x4c90\n cifs_negotiate_protocol+0x1f2/0x3f0\n cifs_get_smb_ses+0x93f/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n Allocated by task 85:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 0 bytes to the right of\n allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)\n which belongs to the cache cifs_small_rq of size 448\n\n BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50\n Read of size 329 at addr ffff88800726c678 by task mount.cifs/89\n CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1\n Call Trace:\n \n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n kasan_check_range+0x10f/0x1e0\n __asan_memcpy+0x23/0x60\n kmemdup_noprof+0x36/0x50\n decode_ntlmssp_challenge+0x457/0x680\n SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0\n SMB2_sess_setup+0x219/0x4f0\n cifs_setup_session+0x248/0xaf0\n cifs_get_smb_ses+0xf79/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n Allocated by task 93:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 120 bytes inside of\n allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)\n which belongs to the cache cifs_small_rq of size 448\n\nRestrict the +1 exemption to responses that have no data area, so that\nit still covers the bcc[0] omission it was meant for. When a data area\nis present, the +1 discrepancy instead means the reported data length\noverruns the\n---truncated---"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB server can trigger the flaw through crafted TCP responses, typically over port 445.\nAC:L - The server directly controls the frame length, data offset, and declared data length, so no race or condition outside the attacker's control is required.\nPR:N - NEGOTIATE and SESSION_SETUP responses are processed before authentication and signature verification, requiring no attacker credentials or local capabilities.\nUI:N - An existing persistent SMB mount automatically renegotiates after a server-induced reconnect, allowing exploitation without contemporaneous user action.\nS:U - The vulnerable SMB decoder and resulting kernel impact remain within the host kernel's security authority.\nC:L - The discrepancy permits exactly one byte beyond the received data to be read; the NTLM path can preserve and reflect that byte in subsequent authentication data, but the disclosure is strictly bounded.\nI:N - The flaw performs an out-of-bounds read and copies data into valid allocations; it provides no out-of-bounds write or other demonstrated memory-modification primitive.\nA:H - The demonstrated slab out-of-bounds access raises a KASAN BUG and can panic hardened kernels, and a malicious peer can retrigger it during negotiation or reconnection."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb2misc.c"],"versions":[{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"8d0bbc78046d264bbf6a574ea6f9072258a43e35","status":"affected","versionType":"git"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0","status":"affected","versionType":"git"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"31c6312608c60b72a1feb99a5afb680645a3e8a3","status":"affected","versionType":"git"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"573e502d14714d2947e22e7eff40ec20a6a44a42","status":"affected","versionType":"git"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"419ec1b604d7fb60c10aec2dc062371f9fcd4940","status":"affected","versionType":"git"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"ceb875a375dedbf51c9425c1d13a2d7a8435c08c","status":"affected","versionType":"git"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"6e9d10f62773b99bd927940fd9cbdfe7207e23ff","status":"affected","versionType":"git"},{"version":"093b2bdad3221e3fae3c26d89387e7297a157664","lessThan":"53b7c271f06be4dd5cfc8c6ef552a8355c891a7f","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb2misc.c"],"versions":[{"version":"3.6","status":"affected"},{"version":"0","lessThan":"3.6","status":"unaffected","versionType":"semver"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.96","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.12.96"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.18.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35"},{"url":"https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0"},{"url":"https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3"},{"url":"https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42"},{"url":"https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940"},{"url":"https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c"},{"url":"https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff"},{"url":"https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f"}],"title":"smb: client: restrict implied bcc[0] exemption to responses without data area","x_generator":{"engine":"bippy-1.2.0"}}}}