CVE-2026-64448
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received ("server can return one byte more due to implied bcc[0]"). This was introduced to accommodate servers that omit the trailing bcc[0] overlap byte when no data area is present. However, the exemption is applied unconditionally, regardless of whether the command actually carries a data area (has_smb2_data_area[]). When a response with a data area is subject to the +1 exemption, the reported data can extend one byte beyond the bytes actually received, yet smb2_check_message() still accepts it. The subsequent decoder then reads past the end of the receive buffer. This is reachable during NEGOTIATE and SESSION_SETUP, before the session is established. The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected: BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00 Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81 CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 asn1_ber_decoder+0x16a7/0x1b00 decode_negTokenInit+0x19/0x30 SMB2_negotiate+0x31d9/0x4c90 cifs_negotiate_protocol+0x1f2/0x3f0 cifs_get_smb_ses+0x93f/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 85: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 0 bytes to the right of allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0) which belongs to the cache cifs_small_rq of size 448 BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50 Read of size 329 at addr ffff88800726c678 by task mount.cifs/89 CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x23/0x60 kmemdup_noprof+0x36/0x50 decode_ntlmssp_challenge+0x457/0x680 SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0 SMB2_sess_setup+0x219/0x4f0 cifs_setup_session+0x248/0xaf0 cifs_get_smb_ses+0xf79/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 93: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 120 bytes inside of allocated 448-byte region [ffff88800726c600, ffff88800726c7c0) which belongs to the cache cifs_small_rq of size 448 Restrict the +1 exemption to responses that have no data area, so that it still covers the bcc[0] omission it was meant for. When a data area is present, the +1 discrepancy instead means the reported data length overruns the ---truncated---
View original CVE JSON
{
"id": "CVE-2026-64448",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-07-25T10:17:29.557",
"lastModified": "2026-10-19T21:17:39.457",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: restrict implied bcc[0] exemption to responses without data area\n\nsmb2_check_message() has a long-standing quirk that accepts a response\nwhose calculated length is one byte larger than the bytes actually\nreceived (\"server can return one byte more due to implied bcc[0]\").\nThis was introduced to accommodate servers that omit the trailing bcc[0]\noverlap byte when no data area is present.\n\nHowever, the exemption is applied unconditionally, regardless of whether\nthe command actually carries a data area (has_smb2_data_area[]). When a\nresponse with a data area is subject to the +1 exemption, the reported\ndata can extend one byte beyond the bytes actually received, yet\nsmb2_check_message() still accepts it. The subsequent decoder then reads\npast the end of the receive buffer. This is reachable during NEGOTIATE\nand SESSION_SETUP, before the session is established.\n\nThe resulting out-of-bounds reads are visible under KASAN when mounting\nagainst a non-conforming server; both the SPNEGO/negTokenInit and the\nNTLMSSP challenge decoders are affected:\n\n BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00\n Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81\n CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1\n Call Trace:\n <TASK>\n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n asn1_ber_decoder+0x16a7/0x1b00\n decode_negTokenInit+0x19/0x30\n SMB2_negotiate+0x31d9/0x4c90\n cifs_negotiate_protocol+0x1f2/0x3f0\n cifs_get_smb_ses+0x93f/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n Allocated by task 85:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 0 bytes to the right of\n allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)\n which belongs to the cache cifs_small_rq of size 448\n\n BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50\n Read of size 329 at addr ffff88800726c678 by task mount.cifs/89\n CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1\n Call Trace:\n <TASK>\n dump_stack_lvl+0x4e/0x70\n print_report+0x157/0x4c9\n kasan_report+0xce/0x100\n kasan_check_range+0x10f/0x1e0\n __asan_memcpy+0x23/0x60\n kmemdup_noprof+0x36/0x50\n decode_ntlmssp_challenge+0x457/0x680\n SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0\n SMB2_sess_setup+0x219/0x4f0\n cifs_setup_session+0x248/0xaf0\n cifs_get_smb_ses+0xf79/0x17e0\n cifs_mount_get_session+0x7f/0x3a0\n cifs_mount+0xb4/0xcf0\n cifs_smb3_do_mount+0x23a/0x1500\n smb3_get_tree+0x3b0/0x630\n vfs_get_tree+0x82/0x2d0\n fc_mount+0x10/0x1b0\n path_mount+0x50d/0x1de0\n __x64_sys_mount+0x20b/0x270\n do_syscall_64+0xee/0x590\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n Allocated by task 93:\n kmem_cache_alloc_noprof+0x106/0x380\n mempool_alloc_noprof+0x116/0x1e0\n cifs_small_buf_get+0x31/0x80\n allocate_buffers+0x10d/0x2b0\n cifs_demultiplex_thread+0x1d5/0x1d50\n kthread+0x2c6/0x390\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n The buggy address is located 120 bytes inside of\n allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)\n which belongs to the cache cifs_small_rq of size 448\n\nRestrict the +1 exemption to responses that have no data area, so that\nit still covers the bcc[0] omission it was meant for. When a data area\nis present, the +1 discrepancy instead means the reported data length\noverruns the\n---truncated---"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "8d0bbc78046d264bbf6a574ea6f9072258a43e35",
"versionType": "git",
"status": "affected"
},
{
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0",
"versionType": "git",
"status": "affected"
},
{
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "31c6312608c60b72a1feb99a5afb680645a3e8a3",
"versionType": "git",
"status": "affected"
},
{
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "573e502d14714d2947e22e7eff40ec20a6a44a42",
"versionType": "git",
"status": "affected"
},
{
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "419ec1b604d7fb60c10aec2dc062371f9fcd4940",
"versionType": "git",
"status": "affected"
},
{
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "ceb875a375dedbf51c9425c1d13a2d7a8435c08c",
"versionType": "git",
"status": "affected"
},
{
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "6e9d10f62773b99bd927940fd9cbdfe7207e23ff",
"versionType": "git",
"status": "affected"
},
{
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "53b7c271f06be4dd5cfc8c6ef552a8355c891a7f",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.261",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.212",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.178",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.145",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.96",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.39",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.4",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:41:01.162608Z",
"id": "CVE-2026-64448",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.6",
"versionEndExcluding": "5.10.261",
"matchCriteriaId": "C5143C8B-0B5A-4B4A-9FBF-0393CD1FE05B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.212",
"matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.178",
"matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.145",
"matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.96",
"matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.39",
"matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.1.4",
"matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}