CVE-2026-64598: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64598 Overview

CVE-2026-64598 is a Linux kernel vulnerability in the SMB client subsystem. The flaw resides in the smb2_aead_req_alloc() function, where an incorrect error code conversion produces an invalid error pointer. The *num_sgs variable is a u32, so passing it directly to ERR_PTR(*num_sgs) fails to produce a valid negative error value. When the returned pointer is later dereferenced by callers, the kernel crashes. The issue affects the smb/client code path used for authenticated encryption with associated data (AEAD) request allocation over SMB2/SMB3 sessions.

Critical Impact
Dereferencing the malformed error pointer can trigger a kernel crash, resulting in denial of service on Linux systems using the SMB client.

Affected Products

Linux kernel smb/client subsystem (SMB2/SMB3 client)
Distributions shipping affected kernel versions prior to the upstream fixes
Stable kernel branches referenced by the linked stable-tree commits

Discovery Timeline

2026-08-06 - CVE-2026-64598 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64598

Vulnerability Analysis

The vulnerability is a Null Pointer Dereference / invalid pointer dereference triggered by improper error code handling inside smb2_aead_req_alloc(). The function returns a pointer, and error conditions are signaled with ERR_PTR(). The ERR_PTR() macro expects a small negative long value representing an errno. The code passed *num_sgs, a u32 unsigned value, into ERR_PTR(). Casting an unsigned 32-bit value directly yields a pointer that is not in the reserved errno range, so IS_ERR() checks by callers do not correctly identify it as an error.

When upper-layer code assumes the returned pointer is valid and dereferences it, the kernel accesses an invalid address and crashes. The fix stores the return value in a signed int ret variable and returns ERR_PTR(ret) correctly, aligning the error path with the rest of the kernel's PTR_ERR/ERR_PTR conventions.

Root Cause

The root cause is a type-mismatch between the unsigned u32 variable and the signed errno convention used by ERR_PTR(). The previous line in the function performed an intermediate cast to int and then long, but the second use site did not. This produced a pointer that neither represented a valid object nor a valid error indicator.

Attack Vector

The defective code path executes during SMB2 AEAD request allocation, which is exercised by the SMB client while communicating with an SMB server. Conditions that cause num_sgs to take an unexpected value drive the function into the broken error path. The impact is a kernel crash affecting availability of the client host. See the upstream fix commits for exact call-site conditions: Linux Kernel Commit 61f2801 and Linux Kernel Commit cad75673.

No public proof-of-concept code is available. The vulnerability manifests through normal SMB client interactions when the error path in smb2_aead_req_alloc() is reached. Refer to the stable-tree commits for authoritative diffs.

Detection Methods for CVE-2026-64598

Indicators of Compromise

Kernel oops or panic entries referencing smb2_aead_req_alloc in dmesg or /var/log/kern.log
Unexpected process termination or system reboot following SMB mount or file I/O operations
Repeated crashes correlated with SMB share activity from a specific server

Detection Strategies

Compare the running kernel version against the fixed versions listed in the referenced stable-tree commits
Inspect cifs.ko / smb_client module source or vendor changelogs for backport of the smb2_aead_req_alloc() fix
Correlate host crash telemetry with SMB client activity to identify affected endpoints

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on BUG:, Oops:, or general protection fault entries containing smb2_aead
Track SMB client mount events and cross-reference with host availability metrics
Monitor unexpected reboots on Linux servers acting as SMB clients to file servers

How to Mitigate CVE-2026-64598

Immediate Actions Required

Apply vendor kernel updates that include the upstream fix commits referenced by the CVE
Reboot into the patched kernel to activate the corrected smb2_aead_req_alloc() error path
On systems that cannot be patched immediately, restrict SMB client usage to trusted, stable servers

Patch Information

The fix is upstream in the Linux stable tree. Refer to Linux Kernel Commit 61f2801, Linux Kernel Commit a187883c, Linux Kernel Commit a1cc432c, Linux Kernel Commit aa37f5fe, and Linux Kernel Commit cad75673. Distribution maintainers have backported the change to supported stable branches.

Workarounds

Unmount SMB shares (umount.cifs) on hosts that do not require SMB connectivity until patching is complete
Blacklist the cifs kernel module on systems that do not need SMB client functionality
Limit SMB mounts to well-understood servers to reduce exposure to unexpected error conditions

bash

# Verify kernel version and check for the fix
uname -r
# Blacklist the cifs module if SMB client is not required
echo "blacklist cifs" | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo update-initramfs -u