Skip to main content

Linux Kernel EUVDEUVD-2026-48925

| CVE-2026-64381 HIGH
Out-of-bounds Write (CWE-787)
2026-07-25 Linux GHSA-v5fg-wc2f-7h9h
Buffer Overflow Linux Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local access with low privileges confirmed; AC:H because heap grooming for privilege escalation requires non-trivial conditions beyond the basic leak trigger.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 08, 2026 - 14:09 vuln.today
CVSS changed
Sep 08, 2026 - 14:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix next buffer leak in receive_encrypted_standard()

receive_encrypted_standard() allocates next_buffer before checking whether the number of compound PDUs already reached MAX_COMPOUND. If the limit check fails, the function returns immediately and the newly allocated next_buffer is not assigned to server->smallbuf/server->bigbuf, making it leaked.

Move the MAX_COMPOUND check before allocating next_buffer.

AnalysisAI

Memory leak in the Linux kernel's SMB client encrypted receive path (receive_encrypted_standard()) allows a local low-privileged user or a cooperative malicious SMB server to exhaust kernel heap memory, with potential for heap grooming-based privilege escalation. The bug was introduced with commit b24df3e30cbf and affects multiple stable kernel series from 4.19 onward. No public exploit code exists and EPSS is 0.22%, but the kernel team's classification of CWE-787 and a C:H/I:H/A:H CVSS score reflect the Linux security team's assessment that the leaked kernel buffer is exploitable beyond simple resource exhaustion.

Technical ContextAI

The vulnerability resides in the SMB/CIFS client subsystem (fs/smb/client/) of the Linux kernel, specifically in the function receive_encrypted_standard(), which handles decryption of incoming SMB3 compound PDUs. When the kernel receives a multi-PDU compound response over an encrypted SMB channel, it pre-allocates a next_buffer (either smallbuf or bigbuf from the kernel CIFS memory pool) before validating whether the number of compound entries has reached the MAX_COMPOUND limit. If the limit check fails, the function returns early with an error, but the already-allocated next_buffer is never assigned to server->smallbuf or server->bigbuf and is never freed, causing a kernel heap memory leak. CWE-787 (Out-of-Bounds Write) is the assigned weakness class, indicating the kernel security team views the leaked, unreferenced kernel buffer as a potential primitive for heap spray or use-after-free-style manipulation, beyond the immediate resource exhaustion impact. Affected CPE is cpe:2.3:a:linux:linux:* spanning all architectures.

RemediationAI

Update the Linux kernel to a patched stable release: 5.10.261 or later for the 5.10 LTS series, 5.15.212 or later for 5.15 LTS, 6.1.178 or later for 6.1 LTS, 6.6.145 or later for 6.6 LTS, 6.12.96 or later for 6.12 LTS, 6.18.39 or later for 6.18, and 7.1.4 or later for 7.1. Ubuntu users should apply updates per USN-8726-1 (https://ubuntu.com/security/notices/USN-8726-1) and USN-8727-1 (https://ubuntu.com/security/notices/USN-8727-1). The upstream patch commits are available at https://git.kernel.org/stable/c/94e4f672db029414b9888b5137a7559f1febf2d8 and related stable backports. As a compensating control where kernel upgrades are not immediately feasible, administrators can restrict or disable SMB3 encrypted client mounts (avoid mounting shares with seal or encrypt options) to prevent the vulnerable code path from being reached; this has the trade-off of disabling SMB encryption in transit.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48925 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy