CVE-2026-64578
Received Received - Intake

Heap-based Out-of-Bounds Read in ksmbd SMB2 Compound Request Handling

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first checking that the compound element is large enough to contain it. StructureSize2 is a 2-byte field at offset 64 (__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element. The compound-walking logic only guarantees that a full 64-byte SMB2 header is present for the trailing element: when NextCommand is 0, len is reduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A remote client can craft a compound request whose last element has exactly 64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte past the receive buffer, producing a slab-out-of-bounds read. BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14 The buggy address is located 172 bytes inside of allocated 173-byte region Workqueue: ksmbd-io handle_ksmbd_work Call Trace: ... kasan_report (mm/kasan/report.c:595) ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) handle_ksmbd_work (fs/smb/server/server.c:119) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Reject any compound element that is too small to hold StructureSize2 before dereferencing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64578
EUVD
EUVD-2026-53272

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a slab-out-of-bounds read vulnerability in the Linux kernel's ksmbd SMB server implementation. It occurs when processing compound SMB2 requests. The code reads a 2-byte StructureSize2 field without first verifying the compound element has enough space. A malicious client can craft a request where the last element is exactly 64 bytes, causing the read to extend past the buffer by one byte.

Detection Guidance

This vulnerability involves a slab-out-of-bounds read in the Linux kernel's ksmbd module due to improper validation of SMB2 compound request sizes. Detection requires checking for kernel logs indicating KASAN slab-out-of-bounds errors related to ksmbd_smb2_check_message. Use dmesg or journalctl to search for 'KASAN: slab-out-of-bounds' and 'ksmbd_smb2_check_message' in kernel logs.

Impact Analysis

This vulnerability could allow a remote attacker to cause a denial of service by crashing the system or potentially execute arbitrary code with kernel privileges. Systems running vulnerable versions of the Linux kernel with ksmbd enabled are at risk if exposed to untrusted networks.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized memory access through a slab-out-of-bounds read in the ksmbd SMB2 message validation. Such memory corruption issues may lead to data leaks or corruption, which are critical concerns under GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Apply the Linux kernel patch that validates compound request sizes before reading StructureSize2. Update to a kernel version containing the fix. If immediate patching is not possible, disable the ksmbd module by unloading it with 'modprobe -r ksmbd' or block SMB2 traffic at the network perimeter until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart