Strix
26.1K

CVE-2026-64380

HIGHCVSS 8.2/10EPSS 0.44%

Last modified

CVE-2026-64380 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.. EPSS estimates a 0.44% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.

Metrics

CVSS 3.1
8.2/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

EPSS Probability
0.44%

36.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 349e13ad30b45998bb9937cfe0b32be6f951976d, < 171605aed68380c2fa75dff9b3a1ed427c50065b; >= 349e13ad30b45998bb9937cfe0b32be6f951976d, < 4213c1208978483021d7d125c131de3985d38f61; >= 349e13ad30b45998bb9937cfe0b32be6f951976d, < 96e889bc1e759c83f25093e8c2f3da31b4973f30; >= 349e13ad30b45998bb9937cfe0b32be6f951976d, < 0de5b8e76847f5de26f364a82c6602c4881c30da; >= 349e13ad30b45998bb9937cfe0b32be6f951976d, < 427eb7eb46425fec845a43e861f3d6e2899cae59; >= 349e13ad30b45998bb9937cfe0b32be6f951976d, < 86c5d470f5d42e61123b2f4b4f0b91f4eee5b980; >= 349e13ad30b45998bb9937cfe0b32be6f951976d, < 46a84715a015cb48e1b9c219dc88c03d8a541ea4; >= 349e13ad30b45998bb9937cfe0b32be6f951976d, < 7ad2bcf2441430bb2e918fb3ef9a90d775a6e422
LinuxLinux5.7

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-64380?
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.
How severe is CVE-2026-64380?
CVE-2026-64380 has a CVSS score of 8.2/10 (HIGH severity). The EPSS model estimates a 0.44% probability of exploitation in the next 30 days.
How do I fix CVE-2026-64380?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-64380?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST