CVE-2026-64578: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64578 Overview

CVE-2026-64578 is a slab out-of-bounds read vulnerability in the Linux kernel's ksmbd in-kernel SMB server. The flaw exists in ksmbd_smb2_check_message() within fs/smb/server/smb2misc.c, where the function reads the 2-byte StructureSize2 field at offset 64 of an SMB2 compound element without first verifying the element is large enough to contain it. A remote client can craft a compound SMB2 request whose trailing element is exactly 64 bytes, causing the read to extend one byte past the allocated receive buffer. The issue was detected by KASAN and is classified as an Out-of-Bounds Read [CWE-125].

Critical Impact
A remote attacker with SMB access to a ksmbd-enabled Linux host can trigger a kernel slab out-of-bounds read, enabling information disclosure or denial of service through kernel memory corruption side effects.

Affected Products

Linux kernel builds with the ksmbd in-kernel SMB3 server enabled
Stable branches referenced by upstream fix commits 15b38176, 2c307126, ea128f06, f0e337e7, and f7550a91
Linux distributions shipping ksmbd without the referenced patches applied

Discovery Timeline

2026-08-05 - CVE-2026-64578 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64578

Vulnerability Analysis

The ksmbd server processes SMB2 compound (chained) requests by iterating through elements linked via the NextCommand field in each SMB2 header. For each element, ksmbd_smb2_check_message() dereferences pdu->StructureSize2, a 2-byte field located at offset 64 (__SMB2_HEADER_STRUCTURE_SIZE) from the element's start.

The compound-walking logic guarantees that a full 64-byte SMB2 header exists for the trailing element when NextCommand is zero. It reduces len to the number of bytes remaining after next_smb2_rcv_hdr_off. However, the check does not ensure two additional bytes past the header are readable. Reading StructureSize2 at offset 64 therefore extends past the buffer when the last element is exactly 64 bytes.

KASAN reports the fault as slab-out-of-bounds in ksmbd_smb2_check_message at fs/smb/server/smb2misc.c:402, with a 2-byte read at 172 bytes into a 173-byte allocated region. The call chain traverses handle_ksmbd_work from the ksmbd-io workqueue.

Root Cause

The root cause is missing bounds validation before dereferencing a header field. The compound-length accounting confirms space for the SMB2 header itself but does not check that sizeof(StructureSize2) bytes beyond the header offset remain in the receive buffer. This is a classic off-by-one boundary condition on a network-parsed structure.

Attack Vector

An unauthenticated or authenticated remote client, depending on the ksmbd share configuration, sends a crafted SMB2 compound request over TCP port 445. The final chained element is sized to exactly 64 bytes so the parser reads two bytes past the allocation. The attacker does not require local access, and the vulnerable code path executes under the ksmbd-io workqueue in kernel context.

No public exploit or proof-of-concept is currently referenced in the CVE data. Exploitation reliably reproduces the KASAN report; weaponization for information disclosure would depend on adjacent slab contents.

Detection Methods for CVE-2026-64578

Indicators of Compromise

Kernel log entries containing KASAN: slab-out-of-bounds in ksmbd_smb2_check_message on hosts with KASAN enabled
Unexpected ksmbd-io worker crashes, oopses, or ksmbd.mountd service restarts correlated with inbound SMB traffic
SMB2 compound requests from untrusted clients where the trailing element length is exactly 64 bytes with NextCommand set to zero

Detection Strategies

Monitor dmesg and /var/log/kern.log for ksmbd-related KASAN, BUG, or oops entries referencing smb2misc.c or ksmbd_smb2_check_message.
Inspect network telemetry for anomalous SMB2 compound requests targeting Linux hosts running ksmbd, particularly requests with minimally sized trailing elements.
Inventory Linux hosts to identify systems with the ksmbd module loaded (lsmod | grep ksmbd) and cross-reference against patched kernel versions.

Monitoring Recommendations

Forward kernel logs from all SMB-serving Linux hosts to a centralized log platform and alert on ksmbd fault signatures.
Baseline expected SMB client populations and alert on new external sources initiating SMB2 sessions.
Track kernel package versions across the fleet and flag hosts running ksmbd on unpatched kernels.

How to Mitigate CVE-2026-64578

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 15b38176, 2c307126, ea128f06, f0e337e7, and f7550a91, or update to a distribution kernel that includes them.
If patching cannot occur immediately, unload the ksmbd module (modprobe -r ksmbd) on hosts not actively serving SMB shares.
Restrict inbound TCP port 445 to trusted management networks using host and perimeter firewalls.

Patch Information

The fix rejects any compound element whose remaining length is too small to contain StructureSize2 before dereferencing it. Refer to the upstream commits: Kernel Git Commit 15b38176, Kernel Git Commit 2c307126, Kernel Git Commit ea128f06, Kernel Git Commit f0e337e7, and Kernel Git Commit f7550a91.

Workarounds

Disable ksmbd and migrate to Samba (smbd) userspace file sharing where feasible until the kernel is patched.
Enforce SMB authentication and disable guest access on any ksmbd share to reduce unauthenticated exposure.
Segment SMB-serving hosts on isolated VLANs and block inbound SMB from untrusted zones with firewall rules.

bash

# Configuration example: temporarily disable ksmbd and block SMB from untrusted networks
systemctl stop ksmbd.service
systemctl disable ksmbd.service
modprobe -r ksmbd

# Restrict SMB (TCP/445) to a trusted management subnet only
iptables -A INPUT -p tcp --dport 445 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j DROP