ksmbd: validate compound request size before reading StructureSize2
CVSS score
8.2
EPSS probability
%0.3
Risk score
0.0
Published
2 mo ago
Kanıt listesindeki ürün ve sürüm eşleşmesini kontrol edin; bazı varyantlar hâlâ etkileniyor olabilir.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
2
Source agreement
Tam uyum
Evidence confidence
%61
Short explanation
CVE-2026-64578 is a memory safety issue in the Linux kernel's ksmbd module due to insufficient bounds checking during SMB2 request validation. It affects older kernel versions and requires patching to resolve. No CVSS score or fixed version is available in public databases, indicating incomplete disclosure or metadata. Remediation involves updating to a patched kernel version or applying the fix from the relevant Git commit hash.
This vulnerability highlights a critical flaw in kernel-level SMB2 request handling, where memory safety checks are bypassed. It could allow attackers to trigger crashes or potentially execute arbitrary code if memory corruption is exploited. Given that older kernel versions remain in use, this issue poses a real-world risk to systems not updated to patched versions.
What should be done?
- Update the Linux kernel to a version that includes the fix (e.g., post-e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9).
- Ensure kernel updates are applied promptly to mitigate risk.
The sources give limited detail on some technical conditions. Review the chain of evidence below before deciding how to act.
Chain of evidence and sources
CVE-2026-64578, Linux çekirdeğindeki ksmbd bileşeninde, bir bileşik SMB2 isteği doğrulandığında, StructureSize2 alanının yer aldığı alan yeterli olup olmadığı kontrol edilmeden, bir slab-çerçeve dışına çıkması nedeniyle bir hata oluşur.
Bu hata, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 2c307126ed8e7adddab82b8e31d962d3a2156ab1 gibi belirli Git commit hash'lerinden önceki Linux çekirdeği sürümlerinde mevcut olup, 5.15 ve üzeri sürümlerde etkilenmez.
CVSS puanı verilmemiştir ve NVD kaydında bir düzeltme sürümü belirtilmemiştir; bu, ciddiyet ve düzeltme bilgilerinin eksik veya tamamlanmamış olduğunu gösterir.
Çekirdek bellek güvenliği analizleriyle tespit edilen bu hata, SMB2 istek işleme sırasında sınırların doğru şekilde kontrol edilmemesiyle ilgilidir.
Show the technical text from the sources
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first checking that the compound element is large enough to contain it. StructureSize2 is a 2-byte field at offset 64 (__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element. The compound-walking logic only guarantees that a full 64-byte SMB2 header is present for the trailing element: when NextCommand is 0, len is reduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A remote client can craft a compound request whose last element has exactly 64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte past the receive buffer, producing a slab-out-of-bounds read. BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14 The buggy address is located 172 bytes inside of allocated 173-byte region Workqueue: ksmbd-io handle_ksmbd_work Call Trace: ... kasan_report (mm/kasan/report.c:595) ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) handle_ksmbd_work (fs/smb/server/server.c:119) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Reject any compound element that is too small to hold StructureSize2 before dereferencing it.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Explanation produced with the local qwen3:4b-instruct model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-64578 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 8.2 | CVSS V3_1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | CVE CNA |
| 8.2 | CVSS V31 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | NVD |
Patch and Remediation Guide
Solution & Remediation Advisory
1 düzeltme kanıtı bulundu; en az 3 ürün veya sürüm hâlâ etkileniyor ya da inceleniyor.
7.1.6-1Debian sid: 7.1.6-1
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-64578 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-64578 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-64578"