PT-2026-64602 · Linux · Linux

CVE-2026-64381 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix next buffer leak in receive encrypted standard()

receive encrypted standard() allocates next buffer before checking whether the number of compound PDUs already reached MAX COMPOUND. If the limit check fails, the function returns immediately and the newly allocated next buffer is not assigned to server->smallbuf/server->bigbuf, making it leaked.

Move the MAX COMPOUND check before allocating next buffer.

Related Identifiers

CVE-2026-64381

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64381 · Security Note
• https://git.kernel.org/stable/c/927d4805aea0a287d36dd4f826ee24d69a2afee3 · Note
• https://git.kernel.org/stable/c/67097772df7791c53d608f04bd31c676ccf79b83 · Note
• https://git.kernel.org/stable/c/9136a08dc29328edd9867f2545e73906ac9df93b · Note
• https://git.kernel.org/stable/c/68fc0b6cc03ca58060c0f36454e169f5fe258974 · Note
• https://git.kernel.org/stable/c/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b · Note
• https://git.kernel.org/stable/c/94e4f672db029414b9888b5137a7559f1febf2d8 · Note
• https://git.kernel.org/stable/c/07e0ab81df1790afa35732a4e8e07ff831b29008 · Note
• https://git.kernel.org/stable/c/297243e365fc9fe2f8e9b7dd535a65d922cd108b · Note