CVE-2026-64380
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64380
EUVD
EUVD-2026-48924

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of POSIX SID (Security Identifier) length parsing in the SMB client. The function posix_info_sid_size() reads the subauthority count from sid[1] but lacks a proper boundary check, allowing buffers with only one byte to pass. This could lead to reading out-of-bounds data when truncated POSIX SIDs are processed.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions. If your kernel is older than the patched version, the system is likely vulnerable.

Impact Analysis

If exploited, this flaw could allow an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code on systems running vulnerable Linux kernel versions. Systems using SMB client functionality with untrusted network inputs are at higher risk.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. This can typically be done through your distribution's package manager (e.g., apt upgrade, yum update). After updating, reboot the system to ensure the new kernel is loaded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart