GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64578 (GCVE-0-2026-64578)

Vulnerability from cvelistv5 – Published: 2026-08-05 08:09 – Updated: 2026-08-19 16:29
VLAI
Title
ksmbd: validate compound request size before reading StructureSize2
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first checking that the compound element is large enough to contain it. StructureSize2 is a 2-byte field at offset 64 (__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element. The compound-walking logic only guarantees that a full 64-byte SMB2 header is present for the trailing element: when NextCommand is 0, len is reduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A remote client can craft a compound request whose last element has exactly 64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte past the receive buffer, producing a slab-out-of-bounds read. BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14 The buggy address is located 172 bytes inside of allocated 173-byte region Workqueue: ksmbd-io handle_ksmbd_work Call Trace: ... kasan_report (mm/kasan/report.c:595) ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402) handle_ksmbd_work (fs/smb/server/server.c:119) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Reject any compound element that is too small to hold StructureSize2 before dereferencing it.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 415d0fff0451ad7ad4caa910f2bb0f562f0fd60f (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 1b6740525f5af90868d557c31b496ae689c8c549 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 2c307126ed8e7adddab82b8e31d962d3a2156ab1 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < f7550a91ab211726f59cb137523b7a9eae1ac6eb (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < f0e337e7db67cc1c832958bbb6c4026bdceacfdb (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 15b38176fd1530372905c602fde51fe89ec8c877 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "415d0fff0451ad7ad4caa910f2bb0f562f0fd60f",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "1b6740525f5af90868d557c31b496ae689c8c549",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "2c307126ed8e7adddab82b8e31d962d3a2156ab1",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "f7550a91ab211726f59cb137523b7a9eae1ac6eb",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "f0e337e7db67cc1c832958bbb6c4026bdceacfdb",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "15b38176fd1530372905c602fde51fe89ec8c877",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate compound request size before reading StructureSize2\n\nWhen ksmbd validates a compound (chained) SMB2 request,\nksmbd_smb2_check_message() reads pdu-\u003eStructureSize2 without first\nchecking that the compound element is large enough to contain it.\nStructureSize2 is a 2-byte field at offset 64\n(__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.\n\nThe compound-walking logic only guarantees that a full 64-byte SMB2\nheader is present for the trailing element: when NextCommand is 0, len is\nreduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A\nremote client can craft a compound request whose last element has exactly\n64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte\npast the receive buffer, producing a slab-out-of-bounds read.\n\n  BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n  Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14\n  The buggy address is located 172 bytes inside of allocated 173-byte region\n  Workqueue: ksmbd-io handle_ksmbd_work\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n   handle_ksmbd_work (fs/smb/server/server.c:119)\n   process_one_work (kernel/workqueue.c:3314)\n   worker_thread (kernel/workqueue.c:3397)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\nReject any compound element that is too small to hold StructureSize2\nbefore dereferencing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is an in-kernel SMB server reached over TCP/445; a remote client triggers the bug by sending a crafted compound SMB2 request that is processed in handle_ksmbd_work() \u2192 ksmbd_verify_smb_message() \u2192 ksmbd_smb2_check_message().\nAC:L - The attacker fully controls compound layout and can set the trailing element\u0027s remaining length to exactly 64 bytes so StructureSize2 is read one byte past the receive buffer; no race or attacker-uncontrollable condition is required.\nPR:N - On affected kernels before the compound SESSION_VALID check, a compound NtLmNegotiate SESSION_SETUP (pre-auth, no credentials) sets work-\u003esess and the trailing element still reaches ksmbd_smb2_check_message(); guest/anonymous SESSION_SETUP likewise needs no host privileges.\nUI:N - Exploitation requires only attacker-sent SMB2 protocol traffic to a listening ksmbd service; no victim user action is needed.\nS:U - The out-of-bounds read and any resulting kernel impact occur in the host ksmbd/workqueue context and do not cross a VM, IOMMU, or other security-authority boundary.\nC:L - The flaw is a strictly bounded slab out-of-bounds read of one byte past the receive buffer (2-byte StructureSize2 at offset 64 when only 64 bytes remain); it may disclose adjacent slab contents but not an arbitrary read primitive.\nI:N - The bug only reads past the buffer for a StructureSize2 comparison; for a 64-byte trailing element every valid command size is then rejected, and there is no out-of-bounds write or other modification primitive.\nA:H - KASAN reports a slab-out-of-bounds BUG in ksmbd_smb2_check_message(), and the same access can oops/panic hardened or redzone-enabled kernels; a remote peer can retrigger it with further crafted compound requests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:02.136Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/415d0fff0451ad7ad4caa910f2bb0f562f0fd60f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b6740525f5af90868d557c31b496ae689c8c549"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c307126ed8e7adddab82b8e31d962d3a2156ab1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7550a91ab211726f59cb137523b7a9eae1ac6eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0e337e7db67cc1c832958bbb6c4026bdceacfdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a"
        },
        {
          "url": "https://git.kernel.org/stable/c/15b38176fd1530372905c602fde51fe89ec8c877"
        }
      ],
      "title": "ksmbd: validate compound request size before reading StructureSize2",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64578",
    "datePublished": "2026-08-05T08:09:33.740Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-19T16:29:02.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64578",
      "date": "2026-09-20",
      "epss": "0.00336",
      "percentile": "0.27072"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-09T01:42:02.000Z",
      "cve": "CVE-2026-64578",
      "id": "msrc_CVE-2026-64578",
      "initial_release_date": "2026-08-07T01:18:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: validate compound request size before reading StructureSize2",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64578.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/smb2misc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "415d0fff0451ad7ad4caa910f2bb0f562f0fd60f",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b6740525f5af90868d557c31b496ae689c8c549",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c307126ed8e7adddab82b8e31d962d3a2156ab1",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f7550a91ab211726f59cb137523b7a9eae1ac6eb",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f0e337e7db67cc1c832958bbb6c4026bdceacfdb",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15b38176fd1530372905c602fde51fe89ec8c877",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/smb2misc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate compound request size before reading StructureSize2\n\nWhen ksmbd validates a compound (chained) SMB2 request,\nksmbd_smb2_check_message() reads pdu-\u003eStructureSize2 without first\nchecking that the compound element is large enough to contain it.\nStructureSize2 is a 2-byte field at offset 64\n(__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.\n\nThe compound-walking logic only guarantees that a full 64-byte SMB2\nheader is present for the trailing element: when NextCommand is 0, len is\nreduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A\nremote client can craft a compound request whose last element has exactly\n64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte\npast the receive buffer, producing a slab-out-of-bounds read.\n\n  BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n  Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14\n  The buggy address is located 172 bytes inside of allocated 173-byte region\n  Workqueue: ksmbd-io handle_ksmbd_work\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)\n   handle_ksmbd_work (fs/smb/server/server.c:119)\n   process_one_work (kernel/workqueue.c:3314)\n   worker_thread (kernel/workqueue.c:3397)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\nReject any compound element that is too small to hold StructureSize2\nbefore dereferencing it."
          }
        ],
        "id": "CVE-2026-64578",
        "lastModified": "2026-08-19T17:20:17.830",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-05T08:16:37.760",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15b38176fd1530372905c602fde51fe89ec8c877"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b6740525f5af90868d557c31b496ae689c8c549"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2c307126ed8e7adddab82b8e31d962d3a2156ab1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/415d0fff0451ad7ad4caa910f2bb0f562f0fd60f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ea128f06d2fb2186f0cac0c9f3e953e4d1f5c29a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f0e337e7db67cc1c832958bbb6c4026bdceacfdb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f7550a91ab211726f59cb137523b7a9eae1ac6eb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T16:48:23+00:00",
      "cve": "CVE-2026-64578",
      "id": "CVE-2026-64578",
      "initial_release_date": "2026-08-05T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: validate compound request size before reading StructureSize2",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64578.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-17T16:31:20Z",
      "cve": "CVE-2026-64578",
      "id": "CVE-2026-64578",
      "initial_release_date": "2026-08-06T01:06:17Z",
      "product_status:known_not_affected": "296",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64578",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64578.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.