CVE-2026-64448

What it actually does

This vulnerability affects the Linux kernel SMB client implementation used for CIFS/SMB2/SMB3 mounts. The SMB2 message validation logic accepts certain server responses that are one byte shorter than their reported length because of a legacy implied bcc[0] compatibility exception. That exception was applied even when the SMB response contained a data area, allowing a malicious or non-conforming SMB server to cause the client-side decoder to read past the end of the received kernel buffer during NEGOTIATE or SESSION_SETUP. The out-of-bounds read occurs before the SMB session is fully established and has been observed in SPNEGO/negTokenInit and NTLMSSP challenge parsing paths. The most likely technical outcomes are kernel memory disclosure in limited circumstances and client-side kernel crash or instability, resulting in denial of service on the system attempting the SMB mount.

Why it matters to the business

Systems that mount SMB/CIFS shares from untrusted, compromised, or spoofed SMB servers could be crashed or destabilized before authentication completes. This can interrupt file access, automation jobs, user logons, backup workflows, or services that depend on SMB mounts. The issue is not currently listed in CISA KEV, is not reported as ransomware-used, and has a low EPSS score, which suggests no broad exploitation signal at this time; however, the CVSS 8.2 rating reflects that exploitation is network-reachable, requires no authentication, and can cause high availability impact.

How an attack unfolds

An attacker positions or operates an SMB server that a vulnerable Linux system will attempt to mount or contact. This could be a malicious server, a compromised file server, a spoofed SMB endpoint, or a server reached through misconfiguration or name-resolution manipulation. When the Linux SMB client initiates the SMB2/SMB3 handshake, the attacker returns a crafted NEGOTIATE or SESSION_SETUP response with a data area whose reported length is inconsistent with the bytes actually received by exactly the legacy tolerated one-byte discrepancy. Because the vulnerable kernel applies the implied bcc[0] exemption even when a data area exists, smb2_check_message() accepts the malformed response. The subsequent SPNEGO or NTLMSSP decoder then reads beyond the allocated CIFS receive buffer. Depending on kernel configuration and memory layout, this can produce a kernel warning, KASAN slab-out-of-bounds report, mount failure, kernel oops, or system crash. Exploitation occurs client-side and before successful SMB authentication, so credentials are not required from the attacker if they can cause the victim system to connect to the malicious SMB service.

How to fix it

Update the Linux kernel to a version that includes the fix restricting the implied bcc[0] +1 length exemption to SMB responses that do not contain a data area. Because no product-specific fixed versions were provided, obtain patched kernel packages from the relevant Linux distribution or vendor advisory channel and reboot into the updated kernel. Where immediate patching is not possible, reduce exposure by preventing systems from mounting SMB shares from untrusted networks, restricting outbound SMB traffic to approved file servers, disabling unnecessary CIFS/SMB mounts, hardening name-resolution paths that could redirect SMB connections, and monitoring or blocking TCP/445 connections to unknown destinations. Mitigations should be treated as temporary because the flaw is in kernel-side parsing logic.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel version matches a vendor build containing the SMB client fix, not merely that an updated package is installed. Check the active kernel with commands such as uname -a and compare against the distribution advisory or changelog for the SMB client patch. Review package changelogs for references to smb2_check_message, implied bcc[0], CIFS, SMB2, or this vulnerability. Validate exposure by inventorying systems with CIFS/SMB mounts in /etc/fstab, systemd mount units, autofs maps, container host mount configurations, or scripts invoking mount.cifs. Confirm that outbound SMB access is limited to authorized servers. In test environments only, KASAN-enabled kernels or controlled malformed SMB responses can verify that the patched client rejects data-area responses with the one-byte overrun instead of passing them to SPNEGO or NTLMSSP decoders.

Typical attack path

1. Attacker prepares an SMB2/SMB3 server or compromises/spoofs an SMB endpoint reachable by Linux clients.
2. Victim system initiates an SMB/CIFS mount or other kernel SMB client connection to the attacker-controlled endpoint.
3. During NEGOTIATE or SESSION_SETUP, the malicious server sends a response with a data area and a one-byte length discrepancy.
4. The vulnerable Linux kernel SMB client incorrectly accepts the malformed response because of the overly broad implied bcc[0] exemption.
5. SPNEGO or NTLMSSP authentication parsing reads beyond the end of the received kernel buffer.
6. The client system experiences kernel memory over-read symptoms, mount failure, kernel oops, or denial of service.

How to detect it

To determine whether exploitation may already have occurred, review kernel logs, system journals, crash dumps, and endpoint telemetry for SMB client parsing failures, kernel out-of-bounds read reports, kernel oops events, or unexplained reboots occurring when mount.cifs, CIFS, SMB2, or SMB3 connections were attempted. Useful log sources include dmesg, /var/log/kern.log, /var/log/messages, journalctl -k, systemd mount unit logs, audit logs for mount syscalls, EDR process/network telemetry, firewall/proxy logs for outbound SMB, and crash dump facilities such as kdump, apport, ABRT, or vmcore storage. Focus on events involving mount.cifs connecting to unfamiliar SMB servers, failed SMB mounts followed by kernel warnings, or stack traces referencing smb2_check_message, SMB2_negotiate, SMB2_sess_setup, asn1_ber_decoder, decode_negTokenInit, or decode_ntlmssp_challenge. Network telemetry should be checked for Linux clients initiating TCP/445 or TCP/139 sessions to unapproved or unusual destinations shortly before crashes or kernel errors. There are no unique attacker file artifacts inherent to this vulnerability; detection is primarily behavioral and crash/log based.

• BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder
• BUG: KASAN: slab-out-of-bounds in kmemdup_noprof
• smb2_check_message
• asn1_ber_decoder
• decode_negTokenInit
• decode_ntlmssp_challenge
• SMB2_negotiate
• SMB2_sess_setup
• SMB2_sess_auth_rawntlmssp_negotiate
• cifs_negotiate_protocol
• cifs_get_smb_ses
• cifs_mount_get_session
• cifs_smb3_do_mount
• smb3_get_tree
• cifs_demultiplex_thread
• cifs_small_buf_get
• cifs_small_rq
• Comm: mount.cifs
• mount.cifs
• TCP/445
• TCP/139

What your security team should do

• Prioritize patching Linux systems that mount SMB/CIFS shares, especially workstations, file-processing servers, backup systems, virtualization hosts, and automation nodes that connect to SMB over networks.
• Restrict outbound TCP/445 and TCP/139 from Linux systems to approved SMB servers only; block SMB access to the internet and untrusted network segments.
• Inventory all CIFS/SMB mounts, including /etc/fstab entries, autofs maps, systemd .mount units, Kubernetes or container host mounts, and scripts using mount.cifs.
• Review DNS, LLMNR, NetBIOS, and other name-resolution controls to reduce the chance of SMB connections being redirected to attacker-controlled hosts.
• Monitor for kernel oops, KASAN, or slab-out-of-bounds messages involving CIFS, SMB2, SPNEGO, NTLMSSP, asn1_ber_decoder, or mount.cifs.
• Treat unexpected SMB mount failures followed by kernel warnings or reboots as potentially suspicious and preserve kernel logs for investigation.
• If patching must be delayed, disable non-essential SMB mounts and isolate systems that must connect to externally managed SMB servers.
• Track distribution advisories for exact fixed kernel package versions and ensure systems are rebooted after kernel updates.