CVE-2026-64381

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64381
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64381.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-64381
Downstream
Related
Published
2026-07-25T08:50:31Z
Modified
2026-08-18T03:30:46Z
Summary
smb: client: Fix next buffer leak in receive_encrypted_standard()
Details

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix next buffer leak in receive_encrypted_standard()

receive_encrypted_standard() allocates next_buffer before checking whether the number of compound PDUs already reached MAX_COMPOUND. If the limit check fails, the function returns immediately and the newly allocated next_buffer is not assigned to server->smallbuf/server->bigbuf, making it leaked.

Move the MAX_COMPOUND check before allocating next_buffer.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64381.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b24df3e30cbf48255db866720fb71f14bf9d2f39
Fixed
94e4f672db029414b9888b5137a7559f1febf2d8
Fixed
68fc0b6cc03ca58060c0f36454e169f5fe258974
Fixed
07e0ab81df1790afa35732a4e8e07ff831b29008
Fixed
9136a08dc29328edd9867f2545e73906ac9df93b
Fixed
67097772df7791c53d608f04bd31c676ccf79b83
Fixed
297243e365fc9fe2f8e9b7dd535a65d922cd108b
Fixed
927d4805aea0a287d36dd4f826ee24d69a2afee3
Fixed
1c6267a1d5cf4c73b656f8181b310cbbb3e4767b

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64381.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.19.0
Fixed
5.10.261
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.96
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.39
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64381.json"