CVE-2026-64448: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64448 Overview

CVE-2026-64448 is an out-of-bounds read vulnerability in the Linux kernel's SMB (Server Message Block) client. The flaw resides in smb2_check_message(), which unconditionally applied a one-byte length exemption originally intended only for responses without a data area. When a malicious or non-conforming SMB server returns a response that includes a data area, the +1 exemption allows the reported data length to overrun the receive buffer. The subsequent decoders then read past the end of the allocated cifs_small_rq slab region. The condition is reachable during the NEGOTIATE and SESSION_SETUP exchanges, before any session is established.

Critical Impact
A remote SMB server can trigger out-of-bounds reads in the CIFS client during unauthenticated mount operations, leading to kernel information disclosure or denial of service.

Affected Products

Linux kernel CIFS/SMB client (fs/smb/client)
Multiple stable branches referenced by the upstream fix commits
Systems mounting SMB shares from untrusted or attacker-controlled servers

Discovery Timeline

2026-07-25 - CVE-2026-64448 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64448

Vulnerability Analysis

The defect lives in the SMB2 message length validation path. smb2_check_message() historically tolerated responses whose calculated length exceeded the received bytes by one, accommodating servers that omit the trailing bcc[0] overlap byte when no data area is present. The exemption was applied unconditionally, without consulting the has_smb2_data_area[] table that indicates whether the specific command carries a data area.

When a response with a data area is subject to the +1 exemption, the reported data length can extend one byte beyond what was actually received. Decoders that consume that reported length then read past the end of the receive buffer. KASAN reports demonstrate the flaw in two distinct call paths: asn1_ber_decoder() invoked from decode_negTokenInit() during SPNEGO handling, and kmemdup_noprof() invoked from decode_ntlmssp_challenge() during NTLMSSP authentication.

Root Cause

The root cause is an over-broad compatibility quirk. The one-byte length exemption was written to accept legitimate responses missing the bcc[0] byte, but the check never verified that the command in question actually lacks a data area. The absence of a guard against has_smb2_data_area[] allowed the exemption to apply to responses that legitimately carry payload data, converting a lenient parser into an out-of-bounds read primitive.

Attack Vector

An attacker who controls or impersonates an SMB server can craft NEGOTIATE or SESSION_SETUP responses that trigger the condition. Because these exchanges occur before session establishment, no authentication is required. A Linux client mounting a share from the attacker-controlled server processes the malformed response, and the CIFS decoders read one byte past the end of the 448-byte cifs_small_rq slab allocation. Depending on adjacent heap contents, this yields information disclosure or a kernel crash under KASAN.

No verified public exploit code is available. See the upstream commits, including Linux Kernel Commit 419ec1b and Linux Kernel Commit 53b7c27, for the precise fix.

Detection Methods for CVE-2026-64448

Indicators of Compromise

KASAN slab-out-of-bounds reports naming asn1_ber_decoder, decode_negTokenInit, decode_ntlmssp_challenge, or kmemdup_noprof in the call stack.
Kernel oops or panic messages generated by mount.cifs invocations against unfamiliar SMB endpoints.
Unexpected CIFS mount attempts to external or non-corporate SMB servers observed in host telemetry.

Detection Strategies

Monitor dmesg and journalctl -k for CIFS client errors originating in SMB2_negotiate or SMB2_sess_setup code paths.
Instrument endpoints with eBPF or auditd rules that record mount syscalls specifying the cifs or smb3 filesystem type and log the target server address.
Correlate SMB session establishment failures with outbound TCP 445 connections to non-approved destinations.

Monitoring Recommendations

Alert on Linux hosts initiating SMB traffic to external IP ranges or newly observed servers.
Track kernel version and CIFS module revisions across the Linux fleet to identify unpatched systems.
Capture network flow metadata for TCP 445 to enable retrospective investigation of suspicious NEGOTIATE exchanges.

How to Mitigate CVE-2026-64448

Immediate Actions Required

Apply the upstream kernel patch series that restricts the +1 exemption to responses without a data area.
Rebuild or update distribution kernels to a version incorporating the fix commits referenced by the NVD entry.
Restrict SMB client egress to trusted file server IP addresses using host or perimeter firewall policy.

Patch Information

The fix modifies smb2_check_message() to consult has_smb2_data_area[] before applying the one-byte tolerance. Reference commits include Linux Kernel Commit 31c6312, Linux Kernel Commit 573e502, Linux Kernel Commit 6e9d10f, Linux Kernel Commit 8d0bbc7, Linux Kernel Commit b6a381c, and Linux Kernel Commit ceb875a. Consult your distribution's security tracker for the corresponding backport.

Workarounds

Block outbound TCP 445 to untrusted networks at host and network firewalls until kernels are patched.
Disable or unload the cifs kernel module on hosts that do not require SMB client functionality.
Restrict mount.cifs and equivalent utilities to administrators through sudo policy and file permissions.

bash

# Configuration example: block outbound SMB and unload the cifs module
sudo iptables -A OUTPUT -p tcp --dport 445 -j REJECT
sudo modprobe -r cifs
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/blacklist-cifs.conf