{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64578","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T15:36:31.798Z","datePublished":"2026-08-05T08:09:33.740Z","dateUpdated":"2026-08-19T16:29:02.136Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:29:02.136Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate compound request size before reading StructureSize2\n\nWhen ksmbd validates a compound (chained) SMB2 request,\nksmbd_smb2_check_message() reads pdu->StructureSize2 without first\nchecking that the compound element is large enough to contain it.\nStructureSize2 is a 2-byte field at offset 64\n(__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.\n\nThe compound-walking logic only guarantees that a full 64-byte SMB2\nheader is present for the trailing element: when NextCommand is 0, len is\nreduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A\nremote client can craft a compound request whose last element has exactly\n64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte\npast the receive buffer, producing a slab-out-of-bounds read.\n\n  BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n  Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14\n  The buggy address is located 172 bytes inside of allocated 173-byte region\n  Workqueue: ksmbd-io handle_ksmbd_work\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n   handle_ksmbd_work (fs/smb/server/server.c:119)\n   process_one_work (kernel/workqueue.c:3314)\n   worker_thread (kernel/workqueue.c:3397)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\nReject any compound element that is too small to hold StructureSize2\nbefore dereferencing it."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - ksmbd is an in-kernel SMB server reached over TCP/445; a remote client triggers the bug by sending a crafted compound SMB2 request that is processed in handle_ksmbd_work() → ksmbd_verify_smb_message() → ksmbd_smb2_check_message().\nAC:L - The attacker fully controls compound layout and can set the trailing element's remaining length to exactly 64 bytes so StructureSize2 is read one byte past the receive buffer; no race or attacker-uncontrollable condition is required.\nPR:N - On affected kernels before the compound SESSION_VALID check, a compound NtLmNegotiate SESSION_SETUP (pre-auth, no credentials) sets work->sess and the trailing element still reaches ksmbd_smb2_check_message(); guest/anonymous SESSION_SETUP likewise needs no host privileges.\nUI:N - Exploitation requires only attacker-sent SMB2 protocol traffic to a listening ksmbd service; no victim user action is needed.\nS:U - The out-of-bounds read and any resulting kernel impact occur in the host ksmbd/workqueue context and do not cross a VM, IOMMU, or other security-authority boundary.\nC:L - The flaw is a strictly bounded slab out-of-bounds read of one byte past the receive buffer (2-byte StructureSize2 at offset 64 when only 64 bytes remain); it may disclose adjacent slab contents but not an arbitrary read primitive.\nI:N - The bug only reads past the buffer for a StructureSize2 comparison; for a 64-byte trailing element every valid command size is then rejected, and there is no out-of-bounds write or other modification primitive.\nA:H - KASAN reports a slab-out-of-bounds BUG in ksmbd_smb2_check_message(), and the same access can oops/panic hardened or redzone-enabled kernels; a remote peer can retrigger it with further crafted compound requests."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2misc.c"],"versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"415d0fff0451ad7ad4caa910f2bb0f562f0fd60f","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"1b6740525f5af90868d557c31b496ae689c8c549","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"2c307126ed8e7adddab82b8e31d962d3a2156ab1","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"f7550a91ab211726f59cb137523b7a9eae1ac6eb","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"f0e337e7db67cc1c832958bbb6c4026bdceacfdb","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"15b38176fd1530372905c602fde51fe89ec8c877","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2misc.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/415d0fff0451ad7ad4caa910f2bb0f562f0fd60f"},{"url":"https://git.kernel.org/stable/c/1b6740525f5af90868d557c31b496ae689c8c549"},{"url":"https://git.kernel.org/stable/c/2c307126ed8e7adddab82b8e31d962d3a2156ab1"},{"url":"https://git.kernel.org/stable/c/f7550a91ab211726f59cb137523b7a9eae1ac6eb"},{"url":"https://git.kernel.org/stable/c/f0e337e7db67cc1c832958bbb6c4026bdceacfdb"},{"url":"https://git.kernel.org/stable/c/ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a"},{"url":"https://git.kernel.org/stable/c/15b38176fd1530372905c602fde51fe89ec8c877"}],"title":"ksmbd: validate compound request size before reading StructureSize2","x_generator":{"engine":"bippy-1.2.0"}}}}