CVE-2026-64380: Linux Kernel Privilege Escalation Flaw

CVE-2026-64380 Overview

CVE-2026-64380 is a boundary validation flaw in the Linux kernel's SMB client component. The posix_info_sid_size() helper reads sid[1] to obtain the subauthority count, but the existing boundary check accepts buffers containing only one remaining byte. This allows an out-of-bounds read when parsing truncated POSIX Security Identifiers (SIDs) returned by an SMB server. A malicious or compromised SMB server can send crafted POSIX metadata to trigger the condition on any client path that reuses the helper.

Critical Impact
A remote SMB server can trigger an out-of-bounds read in the Linux kernel SMB client, leading to information disclosure or kernel-side denial of service without authentication or user interaction.

Affected Products

Linux kernel SMB client (fs/smb/client)
Distributions shipping vulnerable Linux kernel versions with CIFS/SMB client enabled
Systems mounting POSIX-extension SMB shares from untrusted or attacker-controlled servers

Discovery Timeline

2026-07-25 - CVE-2026-64380 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64380

Vulnerability Analysis

The defect resides in posix_info_sid_size() within the Linux kernel SMB client. The function parses POSIX SID structures returned by SMB servers advertising POSIX extensions. A SID structure begins with a revision byte followed by a subauthority count byte at offset 1, then a 6-byte identifier authority, and a variable number of 32-bit subauthorities.

The pre-patch boundary check confirmed at least one byte remained in the buffer before dereferencing sid[1]. Because the subauthority count lives at the second byte, the check permitted reads of memory adjacent to the SMB response buffer. The parser then used the attacker-controlled subauthority count to compute an even larger SID length, propagating corrupted values into downstream callers that reuse the helper. The result is an information leak or an availability impact when subsequent copy operations touch unmapped memory.

Root Cause

The root cause is an off-by-one boundary check [CWE-125: Out-of-Bounds Read]. The comparison guarded against zero-byte buffers but not single-byte buffers, so accessing sid[1] on a one-byte remainder reads past the intended bounds. The fix requires at least two bytes to be present before dereferencing sid[1], ensuring all client code paths reject truncated POSIX SIDs safely.

Attack Vector

Exploitation requires a client to communicate with a hostile SMB server over the network. No authentication or user interaction is needed. An attacker who controls an SMB endpoint, hijacks an unencrypted SMB session, or performs a machine-in-the-middle attack against SMB traffic can return a crafted POSIX response containing a truncated SID. When the client parses that response, the kernel dereferences memory beyond the response buffer.

The vulnerability is described in prose only; refer to the upstream commits listed under Patch Information for the exact bounds-check adjustment.

Detection Methods for CVE-2026-64380

Indicators of Compromise

Kernel oops or panic messages referencing posix_info_sid_size, cifs, or smb in dmesg or /var/log/kern.log
Unexpected disconnects, mount failures, or KASAN out-of-bounds read reports involving the SMB client module
SMB traffic to unfamiliar external hosts on TCP 445 originating from Linux endpoints

Detection Strategies

Inventory Linux hosts running kernels predating the fix commits and mounting SMB shares with POSIX extensions enabled
Enable KASAN in test environments to surface out-of-bounds reads in fs/smb/client during fuzzing of SMB responses
Correlate kernel crash telemetry with SMB session establishment events to identify parsing-triggered faults

Monitoring Recommendations

Alert on Linux kernel crash signatures involving CIFS or SMB client symbols
Monitor outbound SMB (TCP 445) connections from server workloads that should not initiate SMB traffic
Track SMB mount events referencing untrusted or newly observed servers through endpoint telemetry

How to Mitigate CVE-2026-64380

Immediate Actions Required

Apply the upstream Linux kernel patches once your distribution publishes updated packages
Restrict outbound SMB traffic (TCP 445) from Linux hosts to a known allow list of trusted file servers
Require SMB signing and encryption on all client mounts to reduce exposure to machine-in-the-middle tampering
Unmount and avoid SMB shares from untrusted networks until patched kernels are deployed

Patch Information

The fix requires two bytes of buffer remaining before dereferencing sid[1] in posix_info_sid_size(). Vendors have backported the change across stable trees. Reference the upstream commits: 0de5b8e76847, 171605aed683, 4213c1208978, 427eb7eb4642, 46a84715a015, 7ad2bcf24414, 86c5d470f5d4, and 96e889bc1e75.

Workarounds

Disable POSIX extensions on SMB mounts by using mount options that fall back to standard SMB semantics where feasible
Block or firewall outbound SMB connections to networks outside administrative control
Unload the cifs kernel module on hosts that do not require SMB client functionality

bash

# Example: block outbound SMB and unload the CIFS module until patched
sudo iptables -A OUTPUT -p tcp --dport 445 -j REJECT
sudo umount -a -t cifs
sudo modprobe -r cifs