Skip to content
Heist/ feed
Back to feed
Critical

smb: client: reject overlapping data areas in SMB2 responses

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception. Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-64257
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 16:37 UTC · Revision 1

Source evidence

smb: client: reject overlapping data areas in SMB2 responses

core-osv · Original source

Published 25 Jul 2026, 08:49 UTC

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception. Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

osv:CVE-2026-64257
Complete source record
{
  "id": "4e7aec526926d14f97957fb43a674ad5a2632ebca7d5790d4d90a0fb800a3d96",
  "url": "https://osv.dev/vulnerability/CVE-2026-64257",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "smb: client: reject overlapping data areas in SMB2 responses",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b (\"smb: client: restrict implied bcc[0] exemption to responses without data area\") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception. Track data area overlap separately and reject such responses before applying the length compatibility exceptions.",
    "evidence": "osv:CVE-2026-64257",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-64257",
      "aliases": [
        "CVE-2026-64257"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "31c6312608c60b72a1feb99a5afb680645a3e8a3"
                },
                {
                  "fixed": "445ece263131780dee273d727a4d6f11934feec7"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "573e502d14714d2947e22e7eff40ec20a6a44a42"
                },
                {
                  "fixed": "36bfa52459e45c0d5b668de2f1c91f6dc5c67775"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "419ec1b604d7fb60c10aec2dc062371f9fcd4940"
                },
                {
                  "fixed": "4a9d2657d3e05f6ed09c148cb127b4e58702275f"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "ceb875a375dedbf51c9425c1d13a2d7a8435c08c"
                },
                {
                  "fixed": "fdafa1e68dc75045b7b617e6e7d2854950804d83"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6e9d10f62773b99bd927940fd9cbdfe7207e23ff"
                },
                {
                  "fixed": "57cba95f0e97c6f6e45e6731da30aff091bd7460"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "53b7c271f06be4dd5cfc8c6ef552a8355c891a7f"
                },
                {
                  "fixed": "8986c932905ea508d66da421eb2eb6e676ace1fe"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.10.261"
                },
                {
                  "fixed": "5.11"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.15.212"
                },
                {
                  "fixed": "5.16"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8d0bbc78046d264bbf6a574ea6f9072258a43e35"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0"
                }
              ]
            }
          ],
          "versions": [
            "v5.10.272",
            "v5.10.271",
            "v5.10.270",
            "v5.10.269",
            "v5.10.268",
            "v5.10.267",
            "v5.10.266",
            "v5.10.265",
            "v5.10.264",
            "v5.10.263",
            "v5.10.262",
            "v5.10.261",
            "v5.15.223",
            "v5.15.222",
            "v5.15.221",
            "v5.15.220",
            "v5.15.219",
            "v5.15.218",
            "v5.15.217",
            "v5.15.216",
            "v5.15.215",
            "v5.15.214",
            "v5.15.213",
            "v5.15.212"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64257.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.823934013Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/36bfa52459e45c0d5b668de2f1c91f6dc5c67775",
        "https://git.kernel.org/stable/c/445ece263131780dee273d727a4d6f11934feec7",
        "https://git.kernel.org/stable/c/4a9d2657d3e05f6ed09c148cb127b4e58702275f",
        "https://git.kernel.org/stable/c/57cba95f0e97c6f6e45e6731da30aff091bd7460",
        "https://git.kernel.org/stable/c/8986c932905ea508d66da421eb2eb6e676ace1fe",
        "https://git.kernel.org/stable/c/fdafa1e68dc75045b7b617e6e7d2854950804d83",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64257.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-64257",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64257.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-64257",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 497485,
  "published_at": "2026-07-25T08:49:09.345+00:00"
}