{"id":"CVE-2026-64448","title":"kernel: smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)","summary":"A flaw was found in the Linux kernel's Server Message Block (SMB) client. An attacker, by operating a malicious SMB server, could send specially crafted responses during the session negotiation phase. This could cause the client to read be…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 8","enterprise_linux 9"],"published":"2026-07-25","updated":"2026-10-23","sourceUpdated":"2026-10-23T11:18:25+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64448.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64448.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64448"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507033"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64448"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64448"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072540-CVE-2026-64448-5817@gregkh/T"},{"url":"https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35"},{"url":"https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0"},{"url":"https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3"},{"url":"https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42"},{"url":"https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940"},{"url":"https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c"},{"url":"https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff"},{"url":"https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00463,"epssPercentile":0.39952,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:41:01.162608Z"},"scores":{"vendor":7,"cna":8.2},"ingestedAt":"2026-10-16T17:24:46.821Z","slug":"CVE-2026-64448","body":"## Overview\n\nA flaw was found in the Linux kernel's Server Message Block (SMB) client. An attacker, by operating a malicious SMB server, could send specially crafted responses during the session negotiation phase. This could cause the client to read beyond the intended memory buffer, potentially leading to the disclosure of sensitive information from the kernel's memory.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64448.json)\n\n**kernel: smb: client: restrict implied bcc[0] exemption to responses without data area** — rated Moderate by Red Hat. Released 2026-07-25, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n\n## Remediation\n\nAffected","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":228078,"id":"CVE-2026-64448","ts":1792758071965,"field":"cvss","old":"8.2","new":"7"}]}