CVE-2026-64381: Linux Kernel Information Disclosure Flaw

CVE-2026-64381 Overview

CVE-2026-64381 is a memory leak vulnerability in the Linux kernel's SMB client code. The flaw resides in the receive_encrypted_standard() function within the smb/client subsystem. The function allocates a next_buffer before validating whether the number of compound Protocol Data Units (PDUs) has already reached the MAX_COMPOUND limit. When the limit check fails, the function returns without assigning the newly allocated buffer to server->smallbuf or server->bigbuf, leaving the memory orphaned.

The upstream fix reorders operations so the MAX_COMPOUND check runs before allocation, preventing the leak.

Critical Impact
Repeated triggering of the leak path in receive_encrypted_standard() can exhaust kernel memory on SMB clients handling encrypted compound responses, degrading system stability over time.

Affected Products

Linux kernel SMB client (fs/smb/client)
Systems mounting encrypted SMB shares as clients
Kernel branches patched by the upstream commits referenced below

Discovery Timeline

2026-07-25 - CVE-2026-64381 published to the National Vulnerability Database
2026-07-25 - Last updated in the NVD database

Technical Details for CVE-2026-64381

Vulnerability Analysis

The defect exists in receive_encrypted_standard(), which handles incoming encrypted SMB responses on the client side. The function processes compound PDUs, where multiple SMB commands or responses are bundled into a single network message. To manage these, the kernel maintains an internal counter and enforces the MAX_COMPOUND ceiling on how many chained PDUs a single receive operation may process.

The original code path allocated a next_buffer first, then checked the compound counter. If the counter had already reached MAX_COMPOUND, the function returned early without linking the allocation into server->smallbuf or server->bigbuf. Because those pointers are the only structures the SMB client uses to reclaim receive buffers, the allocation had no reachable reference and became unrecoverable kernel memory.

The patch relocates the MAX_COMPOUND comparison ahead of the allocation call. This ensures no buffer is created on the path that will unconditionally return, eliminating the leak at its root.

Root Cause

The root cause is a resource-ordering bug: allocation preceded validation. The function acquired a kernel buffer before determining whether it would be used, and the early-return branch omitted cleanup. This pattern falls under [CWE-401] Missing Release of Memory after Effective Lifetime.

Attack Vector

Triggering the leak requires the Linux client to receive encrypted SMB responses that reach the compound PDU limit. An attacker-controlled or malicious SMB server could craft responses designed to push the client's compound counter to MAX_COMPOUND repeatedly, forcing the vulnerable code path on each interaction. Over time, this degrades available kernel memory on the client and can lead to a denial-of-service condition.

No verified public exploit code is available for this issue. See the upstream commits for the exact source-level change:

Detection Methods for CVE-2026-64381

Indicators of Compromise

Sustained growth in kernel slab allocations attributable to SMB receive buffers with no corresponding release events
Repeated SMB session activity against untrusted or unusual remote servers using encryption
Kernel Out of Memory events or slab_out_of_memory messages on hosts that mount SMB shares

Detection Strategies

Monitor /proc/slabinfo for abnormal growth in SMB-related caches such as cifs_request and cifs_small_rq on client systems
Correlate SMB mount activity with kernel memory pressure metrics collected by node exporters or eBPF probes
Track kernel versions across the fleet and flag hosts running builds that predate the referenced stable patches

Monitoring Recommendations

Alert on repeated kernel warnings originating from fs/smb/client receive paths
Baseline SMB client memory footprint per host and detect drift over multi-day windows
Log outbound SMB connections and inspect for connections to servers outside the approved allowlist

How to Mitigate CVE-2026-64381

Immediate Actions Required

Inventory Linux hosts that mount SMB shares and identify kernels lacking the referenced fix commits
Apply the vendor-supplied stable kernel updates that include the reordered MAX_COMPOUND check
Restrict SMB client connections to known, trusted file servers using host firewalls or network segmentation

Patch Information

The fix is available in multiple stable kernel branches. Distribution vendors ship the change through their standard kernel update channels. Reference the upstream commits: 07e0ab81, 1c6267a1, 297243e3, 67097772, 68fc0b6c, 9136a08d, 927d4805, and 94e4f672.

Workarounds

Disable SMB encryption on trusted internal shares where policy permits, since the leak path is specific to encrypted compound response handling
Avoid mounting SMB shares from untrusted or internet-facing servers until kernels are patched
Schedule periodic reboots of long-running SMB client hosts to reclaim leaked memory as an interim measure

bash

# Verify the running kernel version and rebuild status against upstream stable branches
uname -r

# Example: unmount and disable auto-mounted SMB shares until patched
sudo umount -a -t cifs
sudo systemctl mask remote-fs.target