CVE-2026-64257

smb: client: reject overlapping data areas in SMB2 responses

9.1 CriticalFix available

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject overlapping data areas in SMB2 responses

Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception.

Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

0.66%Up 0.4 points since Jul 25, 2026

What each source reports

CVE List Score used 9.1

smb: client: reject overlapping data areas in SMB2 responses

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject overlapping data areas in SMB2 responses

Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Record: CVE-2026-64257
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

EUVDEUVD-2026-48969 9.1

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject overlapping data areas in SMB2 responses

Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Record: EUVD-2026-48969
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cfrm-7rjv-hj84 9.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject...

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject overlapping data areas in SMB2 responses

Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Record: GHSA-cfrm-7rjv-hj84
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

NVD 9.1

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject overlapping data areas in SMB2 responses

Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Record: CVE-2026-64257
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-64257 9.1

CVE-2026-64257 does not affect BellSoft software

Record: BELL-CVE-2026-64257
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSV 9.1

smb: client: reject overlapping data areas in SMB2 responses

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject overlapping data areas in SMB2 responses

Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Record: CVE-2026-64257
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-06

Show 12 moreShow less

OSVUBUNTU-CVE-2026-64257 8.3

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception. Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Record: UBUNTU-CVE-2026-64257
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-10

OSVCLSA-2026-1791800936 No score

kernel: Fix of 191 CVEs

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165}
openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs {CVE-2026-74642}
ALSA: usb-audio: fix use-after-free in ump_to_endpoint() {CVE-2026-74501}
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
exec: do_close_on_exec() before taking exec_update_lock {CVE-2026-64371}
proc: Fix broken error paths for namespace links {CVE-2026-64371}
proc: protect ptrace_may_access() with exec_update_lock (part 1) {CVE-2026-64371}
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes {CVE-2026-74503}
ALSA: timer: Forcibly close timer instances at closing {CVE-2026-53193}
usb: typec: ucsi: Fix race condition and ordering in port unregistration {CVE-2026-74441}
arp: do not assume dev_hard_header() does not change skb->head {CVE-2026-22988}
netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665}
md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438}
md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050}
mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844}
vsock/virtio: fix zerocopy completion for multi-skb sends {CVE-2026-53365}
vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting {CVE-2026-52994}
mm: do file ownership checks with the proper mount idmap {CVE-2026-64294}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870}
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig {CVE-2026-53208}
slip: bound decode() reads against the compressed packet length {CVE-2026-45843}
net: tls: fix strparser anchor skb leak on offload RX setup failure {CVE-2026-52974}
netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272}
rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131}
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() {CVE-2026-23458}
mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938}
bpf: Fix NULL deref in map_kptr_match_type for scalar regs {CVE-2026-53032}
bpf: Explicitly check accesses to bpf_sock_addr {CVE-2025-40078}
nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980}
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN {CVE-2026-31525}
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() {CVE-2025-21913}
ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() {CVE-2024-57994}
drm/i915/vrr: require valid min/max vfreq for VRR {CVE-2026-68254}
libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}
gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048}
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path {CVE-2026-31708}
ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447}
NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}
netfilter: x_tables: guard option walkers against 1-byte tail reads {CVE-2026-43452}
smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103}
smb: client: harden POSIX SID length parsing {CVE-2026-64380}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
bpf: Allow LPM map access from sleepable…

Record: CLSA-2026-1791800936
Updated: 2026-11-02

OSVCLSA-2026-1791852988 No score

kernel: Fix of 107 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
sctp: validate embedded address parameter length {CVE-2026-74287}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438}
crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after…

Record: CLSA-2026-1791852988
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11476-1 No score

kernel-devel-7.1.7-1.1 on GA media

These are all security issues fixed in the kernel-devel-7.1.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11476-1
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-64257 No score

CVE-2026-64257 in linux - Patched by Root

Root has patched CVE-2026-64257 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-64257
Updated: 2026-11-06

OSVSUSE-SU-2026:23477-1 No score