smb: client: restrict implied bcc[0] exemption to responses without data area
In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received ("server can return one byte more due to implied bcc[0]"). This was introduced to accommodate servers that omit the trailing bcc[0] overlap byte when no data area is present. However, the exemption is applied unconditionally, regardless of whether the command actually carries a data area (has_smb2_data_area[]). When a response with a data area is subject to the +1 exemption, the reported data can extend one byte beyond the bytes actually received, yet smb2_check_message() still accepts it. The subsequent decoder then reads past the end of the receive buffer. This is reachable during NEGOTIATE and SESSION_SETUP, before the session is established. The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected: BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00 Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81 CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1 Call Trace: dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 asn1_ber_decoder+0x16a7/0x1b00 decode_negTokenInit+0x19/0x30 SMB2_negotiate+0x31d9/0x4c90 cif
CVE-2026-64448
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-64448
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "8d0bbc78046d264bbf6a574ea6f9072258a43e35",
"versionType": "git"
},
{
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0",
"versionType": "git"
},
{
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "31c6312608c60b72a1feb99a5afb680645a3e8a3",
"versionType": "git"
},
{
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "573e502d14714d2947e22e7eff40ec20a6a44a42",
"versionType": "git"
},
{
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "419ec1b604d7fb60c10aec2dc062371f9fcd4940",
"versionType": "git"
},
{
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "ceb875a375dedbf51c9425c1d13a2d7a8435c08c",
"versionType": "git"
},
{
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "6e9d10f62773b99bd927940fd9cbdfe7207e23ff",
"versionType": "git"
},
{
"status": "affected",
"version": "093b2bdad3221e3fae3c26d89387e7297a157664",
"lessThan": "53b7c271f06be4dd5cfc8c6ef552a8355c891a7f",
"versionType": "git"
}
],
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-64448
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41051 · Revision 1
- Added to Heist Feed
- Publisher date