CVE-2026-64578

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB3 server. A remote attacker could exploit this vulnerability by crafting a malicious compound SMB2 request. This improper validation of the request size before reading specific data could lead to an out-of-bounds read, potentially causing a denial of service (DoS) on the affected system.

A flaw of moderate severity was found in ksmbd, the Linux kernel's in-kernel SMB3 server. When validating a compound (chained) SMB2 request, the ksmbd_smb2_check_message() function reads the 2-byte StructureSize2 field located at offset 64 of each compound element without first verifying that the element is large enough to contain it. A remote, unauthenticated client could craft a compound SMB2 request whose trailing element is exactly 64 bytes, so the 2-byte read extends past the end of the receive buffer, triggering a slab-out-of-bounds read that can crash the kernel and cause a denial of service. Red Hat rated this flaw moderate severity (CVSS 5.5), lower than the upstream CVEORG rating of important (8.2), reflecting that this is a 2-byte out-of-bounds read whose primary impact is availability. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected by this flaw because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.