{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-64578", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.798Z", "datePublished": "2026-08-05T08:09:33.740Z", "dateUpdated": "2026-08-19T16:29:02.136Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:29:02.136Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate compound request size before reading StructureSize2\n\nWhen ksmbd validates a compound (chained) SMB2 request,\nksmbd_smb2_check_message() reads pdu->StructureSize2 without first\nchecking that the compound element is large enough to contain it.\nStructureSize2 is a 2-byte field at offset 64\n(__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.\n\nThe compound-walking logic only guarantees that a full 64-byte SMB2\nheader is present for the trailing element: when NextCommand is 0, len is\nreduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A\nremote client can craft a compound request whose last element has exactly\n64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte\npast the receive buffer, producing a slab-out-of-bounds read.\n\n BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14\n The buggy address is located 172 bytes inside of allocated 173-byte region\n Workqueue: ksmbd-io handle_ksmbd_work\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n handle_ksmbd_work (fs/smb/server/server.c:119)\n process_one_work (kernel/workqueue.c:3314)\n worker_thread (kernel/workqueue.c:3397)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\nReject any compound element that is too small to hold StructureSize2\nbefore dereferencing it." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - ksmbd is an in-kernel SMB server reached over TCP/445; a remote client triggers the bug by sending a crafted compound SMB2 request that is processed in handle_ksmbd_work() → ksmbd_verify_smb_message() → ksmbd_smb2_check_message().\nAC:L - The attacker fully controls compound layout and can set the trailing element's remaining length to exactly 64 bytes so StructureSize2 is read one byte past the receive buffer; no race or attacker-uncontrollable condition is required.\nPR:N - On affected kernels before the compound SESSION_VALID check, a compound NtLmNegotiate SESSION_SETUP (pre-auth, no credentials) sets work->sess and the trailing element still reaches ksmbd_smb2_check_message(); guest/anonymous SESSION_SETUP likewise needs no host privileges.\nUI:N - Exploitation requires only attacker-sent SMB2 protocol traffic to a listening ksmbd service; no victim user action is needed.\nS:U - The out-of-bounds read and any resulting kernel impact occur in the host ksmbd/workqueue context and do not cross a VM, IOMMU, or other security-authority boundary.\nC:L - The flaw is a strictly bounded slab out-of-bounds read of one byte past the receive buffer (2-byte StructureSize2 at offset 64 when only 64 bytes remain); it may disclose adjacent slab contents but not an arbitrary read primitive.\nI:N - The bug only reads past the buffer for a StructureSize2 comparison; for a 64-byte trailing element every valid command size is then rejected, and there is no out-of-bounds write or other modification primitive.\nA:H - KASAN reports a slab-out-of-bounds BUG in ksmbd_smb2_check_message(), and the same access can oops/panic hardened or redzone-enabled kernels; a remote peer can retrigger it with further crafted compound requests." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/smb2misc.c" ], "versions": [ { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "415d0fff0451ad7ad4caa910f2bb0f562f0fd60f", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "1b6740525f5af90868d557c31b496ae689c8c549", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "2c307126ed8e7adddab82b8e31d962d3a2156ab1", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "f7550a91ab211726f59cb137523b7a9eae1ac6eb", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "f0e337e7db67cc1c832958bbb6c4026bdceacfdb", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "15b38176fd1530372905c602fde51fe89ec8c877", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/smb2misc.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/415d0fff0451ad7ad4caa910f2bb0f562f0fd60f" }, { "url": "https://git.kernel.org/stable/c/1b6740525f5af90868d557c31b496ae689c8c549" }, { "url": "https://git.kernel.org/stable/c/2c307126ed8e7adddab82b8e31d962d3a2156ab1" }, { "url": "https://git.kernel.org/stable/c/f7550a91ab211726f59cb137523b7a9eae1ac6eb" }, { "url": "https://git.kernel.org/stable/c/f0e337e7db67cc1c832958bbb6c4026bdceacfdb" }, { "url": "https://git.kernel.org/stable/c/ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a" }, { "url": "https://git.kernel.org/stable/c/15b38176fd1530372905c602fde51fe89ec8c877" } ], "title": "ksmbd: validate compound request size before reading StructureSize2", "x_generator": { "engine": "bippy-1.2.0" } } } }