CVE-2026-64448

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read issue exists in the SMB client. The smb2 check message() function incorrectly applies a one-byte length exemption unconditionally, regardless of whether the command contains a data area. When a response includes a data area and this exemption is applied, the reported data length can exceed the actual bytes received. This allows subsequent decoders to read past the end of the receive buffer during NEGOTIATE and SESSION SETUP phases before a session is established. This issue specifically affects the SPNEGO/negTokenInit and NTLMSSP challenge decoders when interacting with non-conforming servers. The vulnerability involves the has smb2 data area[] variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.