CVE-2026-64380

A flaw was found in the Linux kernel's Server Message Block (SMB) client. The vulnerability exists in the posix_info_sid_size() function, which is responsible for parsing POSIX Security Identifiers (SIDs). An insufficient boundary check allows the system to accept truncated POSIX SIDs, which could lead to unexpected behavior or a denial of service. This issue has been resolved by requiring at least two bytes before reading the subauthority count, ensuring that all client paths safely reject malformed SIDs.

A one byte out of bounds read in the SMB client POSIX SID parser can occur because posix_info_sid_size reads sid(1) even when only one byte remains in the received buffer. A malicious or compromised SMB server can trigger this by returning a truncated POSIX SID in an SMB2 POSIX information response, causing the client kernel to read past the validated buffer boundary and potentially crash. For the CVSS the PR:N is used because the malformed data can be supplied by a remote SMB server or network attacker without a local account on the client. User interaction is set to UI:R because the victim client normally has to mount or access an SMB share that reaches this parsing path. Impact is primarily denial of service via kernel crash. For the paranoid score, limited confidentiality impact is kept because the bug class is an out of bounds read, but integrity impact is not raised because the patch does not show a write primitive or UAF.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.