CVE-2026-64598

Received Received - Intake

Kernel Memory Corruption in SMB Client

Publication date: 2026-08-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2_aead_req_alloc() The "*num_sgs" variable is a u32 so "ERR_PTR(*num_sgs)" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler to store the return in an int ret variable. This bug would eventually result in a crash when dereference the invalid error pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-06

EPSS Evaluated

2026-11-07

NVD

CVE-2026-64598

EUVD

EUVD-2026-53785

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where an incorrect error pointer is created due to improper type casting. The code attempts to use ERR_PTR with a u32 variable, which fails because ERR_PTR expects a long integer. This leads to an invalid error pointer that later causes a system crash when dereferenced.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and may not have direct network detection methods. Monitor kernel logs for crashes or errors related to smb2_aead_req_alloc() or SMB client operations. Check for kernel oops messages or system crashes after SMB operations.

Impact Analysis

If exploited, this vulnerability could crash the system by dereferencing an invalid error pointer. This may lead to denial of service, data corruption, or potential privilege escalation if an attacker can trigger the condition.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory management issue in the SMB client component. Compliance impact would only occur if the vulnerability leads to system crashes or data corruption during file operations, which could indirectly affect data integrity requirements.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this issue. If using a distribution with backported fixes, ensure your kernel version includes the patch for smb2_aead_req_alloc(). Avoid using SMB client features until patched. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-64598. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...