---
id: CVE-2026-64448
title: >-
  kernel: smb: client: restrict implied bcc[0] exemption to responses without
  data area (CVE-2026-64448)
summary: >-
  A flaw was found in the Linux kernel's Server Message Block (SMB) client. An
  attacker, by operating a malicious SMB server, could send specially crafted
  responses during the session negotiation phase. This could cause the client to
  read be…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-07-25'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:18:25+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64448.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64448.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64448'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507033'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64448'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64448'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072540-CVE-2026-64448-5817@gregkh/T
  - url: 'https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35'
  - url: 'https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0'
  - url: 'https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3'
  - url: 'https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42'
  - url: 'https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940'
  - url: 'https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c'
  - url: 'https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff'
  - url: 'https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00463
epssPercentile: 0.39952
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:41:01.162608Z'
scores:
  vendor: 7
  cna: 8.2
ingestedAt: '2026-10-16T17:24:46.821Z'
---

## Overview

A flaw was found in the Linux kernel's Server Message Block (SMB) client. An attacker, by operating a malicious SMB server, could send specially crafted responses during the session negotiation phase. This could cause the client to read beyond the intended memory buffer, potentially leading to the disclosure of sensitive information from the kernel's memory.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64448.json)

**kernel: smb: client: restrict implied bcc[0] exemption to responses without data area** — rated Moderate by Red Hat. Released 2026-07-25, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7

## Remediation

Affected