CVE-2026-64448

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restrict implied bcc[0] exemption to responses without data area

smb2_check_message() has a long-standing quirk that accepts a response

whose calculated length is one byte larger than the bytes actually

received ("server can return one byte more due to implied bcc[0]").

This was introduced to accommodate servers that omit the trailing bcc[0]

overlap byte when no data area is present.

However, the exemption is applied unconditionally, regardless of whether

the command actually carries a data area (has_smb2_data_area[]). When a

response with a data area is subject to the +1 exemption, the reported

data can extend one byte beyond the bytes actually received, yet

smb2_check_message() still accepts it. The subsequent decoder then reads

past the end of the receive buffer. This is reachable during NEGOTIATE

and SESSION_SETUP, before the session is established.

The resulting out-of-bounds reads are visible

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References