Skip to main content

Linux Kernel CVE-2026-64380

| EUVDEUVD-2026-48924 HIGH
2026-07-25 Linux GHSA-86gc-pxpc-4p5h
Information Disclosure Linux
8.2
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI
5.9 MEDIUM

Requires client to mount SMB share negotiating POSIX extensions (AC:H, UI:R); server controls payload without client privileges (PR:N); one-byte OOB leak (C:L) with crash risk (A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 27, 2026 - 05:41 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
8.2 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 cve.org
HIGH 8.2

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: harden POSIX SID length parsing

posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.

AnalysisAI

Out-of-bounds read in the Linux kernel's SMB/CIFS client POSIX SID parser allows a malicious or MITM SMB server to cause kernel memory disclosure and denial of service on connecting clients. The posix_info_sid_size() helper reads sid[1] (the SubAuthorityCount byte) after validating only one remaining byte, permitting a truncated server-supplied POSIX SID to trigger a one-byte OOB read - leaking a byte of kernel heap context (C:L) and risking a crash (A:H). No public exploit code exists and EPSS is 0.22%, but the vulnerability is client-facing and triggered entirely from the server side without client-side privilege. Patches are available across all maintained stable branches.

Technical ContextAI

The affected code resides in the Linux kernel's CIFS/SMB client subsystem (fs/smb/client), specifically in the POSIX SID length parsing helper posix_info_sid_size(). A Windows SID structure begins with a Revision byte at offset 0 and a SubAuthorityCount byte at offset 1. When the kernel parses POSIX SID data returned by an SMB server, it calculates the SID's total length by reading SubAuthorityCount (sid[1]), then uses that value to advance through the response buffer. The pre-fix boundary check permitted buffers containing only one remaining byte - enough to read sid[0] (Revision) but not sid[1] (SubAuthorityCount) - resulting in a CWE-125 out-of-bounds read of one byte past the validated region. The fix requires a minimum of two bytes before the read. Affected CPEs: cpe:2.3:a:linux:linux. Introduced with commit 349e13ad30b4 (Linux 5.7), affecting the full stable series until patched.

RemediationAI

Apply the vendor-released kernel patches: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, or 7.1.4 for respective stable branches. Ubuntu users should apply USN-8726-1 or USN-8727-1 as appropriate (https://ubuntu.com/security/notices/USN-8726-1, https://ubuntu.com/security/notices/USN-8727-1). As a compensating control prior to patching, restrict SMB mounts to trusted servers only and avoid mounting SMB shares that negotiate POSIX extensions (unix option in mount.cifs) from untrusted or internet-facing SMB endpoints - note this limits interoperability with Samba-based POSIX-extended shares. Blocking outbound SMB (port 445/TCP) to untrusted networks also reduces exposure for clients that do not require external SMB access.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64380 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy