CVE-2026-64257
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In the Linux kernel SMB (CIFS) client, a vulnerability exists where responses with overlapping data areas are rejected. The __smb2_calc_size() function clears data_length, which can make an invalid response appear valid.
Risk Assessment
An attacker could send a crafted SMB2 response that could lead to undefined behavior or data leakage.
Recommendation
Apply the Linux kernel patch that tracks data area overlap separately and rejects such responses before applying length compatibility exceptions.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception. Track data area overlap separately and reject such responses before applying the length compatibility exceptions.