CVE-2026-64381 (GCVE-0-2026-64381)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix next buffer leak in receive_encrypted_standard()
receive_encrypted_standard() allocates next_buffer before checking
whether the number of compound PDUs already reached MAX_COMPOUND. If
the limit check fails, the function returns immediately and the newly
allocated next_buffer is not assigned to server->smallbuf/server->bigbuf,
making it leaked.
Move the MAX_COMPOUND check before allocating next_buffer.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94e4f672db029414b9888b5137a7559f1febf2d8",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "68fc0b6cc03ca58060c0f36454e169f5fe258974",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "07e0ab81df1790afa35732a4e8e07ff831b29008",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "9136a08dc29328edd9867f2545e73906ac9df93b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "67097772df7791c53d608f04bd31c676ccf79b83",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "297243e365fc9fe2f8e9b7dd535a65d922cd108b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "927d4805aea0a287d36dd4f826ee24d69a2afee3",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "1c6267a1d5cf4c73b656f8181b310cbbb3e4767b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix next buffer leak in receive_encrypted_standard()\n\nreceive_encrypted_standard() allocates next_buffer before checking\nwhether the number of compound PDUs already reached MAX_COMPOUND. If\nthe limit check fails, the function returns immediately and the newly\nallocated next_buffer is not assigned to server-\u003esmallbuf/server-\u003ebigbuf,\nmaking it leaked.\n\nMove the MAX_COMPOUND check before allocating next_buffer."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:32.853Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94e4f672db029414b9888b5137a7559f1febf2d8"
},
{
"url": "https://git.kernel.org/stable/c/68fc0b6cc03ca58060c0f36454e169f5fe258974"
},
{
"url": "https://git.kernel.org/stable/c/07e0ab81df1790afa35732a4e8e07ff831b29008"
},
{
"url": "https://git.kernel.org/stable/c/9136a08dc29328edd9867f2545e73906ac9df93b"
},
{
"url": "https://git.kernel.org/stable/c/67097772df7791c53d608f04bd31c676ccf79b83"
},
{
"url": "https://git.kernel.org/stable/c/297243e365fc9fe2f8e9b7dd535a65d922cd108b"
},
{
"url": "https://git.kernel.org/stable/c/927d4805aea0a287d36dd4f826ee24d69a2afee3"
},
{
"url": "https://git.kernel.org/stable/c/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b"
}
],
"title": "smb: client: Fix next buffer leak in receive_encrypted_standard()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64381",
"datePublished": "2026-07-25T08:50:31.209Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-08-17T04:54:32.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…