CVE-2026-64257 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject overlapping data areas in SMB2 responses
Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to
responses without data area") restricted the implied bcc[0] length
exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception.
Track data area overlap separately and reject such responses before applying the length compatibility exceptions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability resides within the Linux kernel's SMB client implementation, specifically addressing a flaw in how overlapping data areas in SMB2 responses are handled. This issue stems from an incomplete fix that was previously applied to address similar concerns in the SMB protocol processing. The original commit 53b7c271f06b attempted to restrict the implied bcc[0] length exception to responses that lack a data area, but this approach contained a critical oversight that could be exploited by malicious actors. When processing SMB2 responses, the kernel's __smb2_calc_size() function clears the data_length field during overlap handling, which can cause a response that legitimately contains overlapping data areas to appear as if it has no data area at all. This erroneous state then allows the response to qualify for the bcc[0] length exception that was intended to be restricted, creating a potential security loophole.
The technical flaw manifests in the kernel's SMB client processing logic where the overlap detection mechanism fails to properly track whether data areas actually exist or overlap. When the __smb2_calc_size() function processes a response with overlapping data areas, it modifies internal state variables in a way that obscures the true nature of the response structure. This state modification causes the system to incorrectly determine that no data area exists, thereby enabling the application of length compatibility exceptions that should only apply to responses without data areas. The vulnerability essentially allows an attacker to craft SMB2 responses that exploit this logic flaw to bypass intended security controls and potentially execute unauthorized operations.
The operational impact of this vulnerability is significant for Linux systems that implement SMB client functionality, particularly those that communicate with SMB servers in networked environments. An attacker could potentially craft malicious SMB2 responses that contain overlapping data areas, causing the kernel's SMB client to incorrectly process these responses and apply inappropriate length handling exceptions. This could lead to memory corruption issues, denial of service conditions, or potentially arbitrary code execution depending on how the malformed responses are processed downstream. The vulnerability affects systems where SMB client functionality is enabled and actively used for network file access operations, making it particularly concerning for enterprise environments that rely heavily on SMB-based file sharing.
The security implications extend beyond simple protocol handling to encompass potential memory safety violations and system stability concerns, with this issue mapping to CWE-129 Input Validation and Validation of Input Bounds. According to ATT&CK framework, this vulnerability could be leveraged as part of a lateral movement or privilege escalation technique through the use of malicious network protocols. To mitigate this vulnerability, the kernel implementation must track data area overlap separately from the bcc[0] length exception logic, ensuring that responses with overlapping data areas are rejected before any length compatibility exceptions are applied. This requires modifying the processing flow to maintain proper state tracking of data area existence and overlap conditions, preventing the erroneous clearing of data_length that currently enables this attack vector. System administrators should ensure their Linux kernels are updated to versions containing the corrected implementation, while network security teams should monitor for unusual SMB traffic patterns that might indicate exploitation attempts.