CVE-2026-64257
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exception. Track data area overlap separately and reject such responses before applying the length compatibility exceptions.
Affected versions
Linux kernel versions
5.10.261,
5.15.212,
7.2-rc3
and later are affected. Fixed in
7.2-rc4
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-64257?
CVE-2026-64257 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10.261 onward and has been patched in 7.2-rc4. CVE-2026-64257 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64257?
Yes. CVE-2026-64257 has been patched. Fixed versions include 7.2-rc4. If you are running Linux kernel 5.10.261 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64257 actively exploited?
No. CVE-2026-64257 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.