What is CVE-2026-64257?

CVE-2026-64257 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.1 out of 10, affecting Linux kernel versions from 5.10.261 onward and patched in 5.11 and 5.16. CVE-2026-64257 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-64257?

CVE-2026-64257 has a CVSS score of 9.1 out of 10, rated Critical severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

Is there a patch available for CVE-2026-64257?

Yes, CVE-2026-64257 has been patched. Fixed versions include 5.11 and 5.16. If you are running Linux kernel 5.10.261 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-64257 actively exploited?

CVE-2026-64257 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-64257

Critical

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception. Track data area overlap separately and reject such responses before applying the length compatibility exceptions.

Package Linux Kernel

Published 2026-07-25

Last modified 2026-08-17

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

9.1

out of 10

Critical

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected versions

Linux kernel versions 5.10.261, 5.15.212 and later are affected. Fixed in 5.11, 5.16 and their respective stable series.

Affected from

≥ 5.10.261 ≥ 5.15.212

Fixed in

✓ 5.11 5.11.x ✓ 5.16 5.16.x

References

6 total

Kernel Git
https://git.kernel.org/stable/c/36bfa52459e45c0d5b668de2f1c91f6dc5c67775

Patch
Kernel Git
https://git.kernel.org/stable/c/445ece263131780dee273d727a4d6f11934feec7

Patch
Kernel Git
https://git.kernel.org/stable/c/4a9d2657d3e05f6ed09c148cb127b4e58702275f

Patch
Kernel Git
https://git.kernel.org/stable/c/57cba95f0e97c6f6e45e6731da30aff091bd7460

Patch
Kernel Git
https://git.kernel.org/stable/c/8986c932905ea508d66da421eb2eb6e676ace1fe

Patch

Showing 5 of 6 references View all on NVD

Details

CVE ID CVE-2026-64257

Severity Critical

CVSS score 9.1 / 10

CVSS version 3.1

Published 2026-07-25

Modified 2026-08-17

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-64257?

CVE-2026-64257 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.1 out of 10 . It affects Linux kernel versions from 5.10.261 onward and has been patched in 5.11 and 5.16. CVE-2026-64257 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-64257?

CVE-2026-64257 has a CVSS score of 9.1 out of 10, rated Critical severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
Is there a patch available for CVE-2026-64257?

Yes. CVE-2026-64257 has been patched. Fixed versions include 5.11 and 5.16. If you are running Linux kernel 5.10.261 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-64257 actively exploited?

No. CVE-2026-64257 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.