CVE-2026-64380

Published: Jul 25, 2026Modified: Oct 19, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Exploitability: 3.9 / Impact: 4.2

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.

Affected (8)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	5.11 ≤ version < 5.15.212
Linux Linux Kernel	5.16 ≤ version < 6.1.178
Linux Linux Kernel	5.7 ≤ version < 5.10.261
Linux Linux Kernel	6.13 ≤ version < 6.18.39
Linux Linux Kernel	6.19 ≤ version < 7.1.4
Linux Linux Kernel	6.2 ≤ version < 6.6.145
Linux Linux Kernel	6.7 ≤ version < 6.12.96
Linux Linux Kernel	Version 7.2 rc1