What is the CVSS score of CVE-2026-64257?

CVE-2026-64257 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64257?

Yes, a patch is available for CVE-2026-64257. Update the affected software to the latest version immediately.

Linux CVE-2026-64257

EUVD-2026-48969 CRITICAL

2026-07-25 Linux

GHSA-cfrm-7rjv-hj84

Information Disclosure Linux

9.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SUSE

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 05:27 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

9.1 (CRITICAL)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:49 cve.org

CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject overlapping data areas in SMB2 responses

Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception.

Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

AnalysisAI

Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64257 vulnerability details – vuln.today

Back

Linux CVE-2026-64257

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code