CVE-2026-64598

A flaw was found in the Linux kernel's Server Message Block (SMB) client. Incorrect error handling within the smb2_aead_req_alloc() function can lead to the dereferencing of an invalid pointer. This issue could result in a system crash, causing a Denial of Service (DoS).

This vulnerability is rated as Moderate because exploitation is limited to causing a denial of service via a kernel panic, without allowing unauthorized data exposure or modification. In typical Red Hat Enterprise Linux environments, the SMB client kernel module is not loaded by default and requires explicit mounting of remote shares configured with SMB encryption. Furthermore, mounting filesystems generally requires administrative privileges, restricting the ability of unprivileged local users to trigger the vulnerable error path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.