CVE-2026-64598

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2_aead_req_alloc() The "*num_sgs" variable is a u32 so "ERR_PTR(*num_sgs)" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler to store the return in an int ret variable. This bug would eventually result in a crash when dereference the invalid error pointer.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-08-06 08:16:35.473000

Last modified

2026-10-19 21:17:49.143000

View original CVE JSON

{
  "id": "CVE-2026-64598",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-08-06T08:16:35.473",
  "lastModified": "2026-10-19T21:17:49.143",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: Fix error code in smb2_aead_req_alloc()\n\nThe \"*num_sgs\" variable is a u32 so \"ERR_PTR(*num_sgs)\" doesn't work.\nWe would have to do something similar to the previous line where it's\ncast to int and then long.  However, it's simpler to store the return in\nan int ret variable.\n\nThis bug would eventually result in a crash when dereference the invalid\nerror pointer."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "lessThan": "aa37f5fef78dd11cbf983269da2031e12625c56d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "lessThan": "cad756733dc3985188983f3e2eb77e2927209099",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "lessThan": "a187883cc1dc784a4d32537f5d316f1b7b9ad76f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "lessThan": "a1cc432cb0b0a1f74f98a0db3b94ca880c7947ac",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "lessThan": "61f28012e5650c619223decdb7970e0d3162e949",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.3",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.3",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.145",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.96",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.39",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.4",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T15:43:26.477617Z",
          "id": "CVE-2026-64598",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/61f28012e5650c619223decdb7970e0d3162e949",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a187883cc1dc784a4d32537f5d316f1b7b9ad76f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a1cc432cb0b0a1f74f98a0db3b94ca880c7947ac",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/aa37f5fef78dd11cbf983269da2031e12625c56d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cad756733dc3985188983f3e2eb77e2927209099",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}