{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.96-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  smb: client: restrict implied bcc[0] exemption to responses without data area  smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received (\"server can return one byte more due to implied bcc[0]\"). This was introduced to accommodate servers that omit the trailing bcc[0] overlap byte when no data area is present.  However, the exemption is applied unconditionally, regardless of whether the command actually carries a data area (has_smb2_data_area[]).  When a response with a data area is subject to the +1 exemption, the reported data can extend one byte beyond the bytes actually received, yet smb2_check_message() still accepts it.  The subsequent decoder then reads past the end of the receive buffer.  This is reachable during NEGOTIATE and SESSION_SETUP, before the session is established.  The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:    BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00   Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81   CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x4e/0x70    print_report+0x157/0x4c9    kasan_report+0xce/0x100    asn1_ber_decoder+0x16a7/0x1b00    decode_negTokenInit+0x19/0x30    SMB2_negotiate+0x31d9/0x4c90    cifs_negotiate_protocol+0x1f2/0x3f0    cifs_get_smb_ses+0x93f/0x17e0    cifs_mount_get_session+0x7f/0x3a0    cifs_mount+0xb4/0xcf0    cifs_smb3_do_mount+0x23a/0x1500    smb3_get_tree+0x3b0/0x630    vfs_get_tree+0x82/0x2d0    fc_mount+0x10/0x1b0    path_mount+0x50d/0x1de0    __x64_sys_mount+0x20b/0x270    do_syscall_64+0xee/0x590    entry_SYSCALL_64_after_hwframe+0x77/0x7f    \u003c/TASK\u003e   Allocated by task 85:    kmem_cache_alloc_noprof+0x106/0x380    mempool_alloc_noprof+0x116/0x1e0    cifs_small_buf_get+0x31/0x80    allocate_buffers+0x10d/0x2b0    cifs_demultiplex_thread+0x1d5/0x1d50    kthread+0x2c6/0x390    ret_from_fork+0x36e/0x5a0    ret_from_fork_asm+0x1a/0x30   The buggy address is located 0 bytes to the right of    allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)    which belongs to the cache cifs_small_rq of size 448    BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50   Read of size 329 at addr ffff88800726c678 by task mount.cifs/89   CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G    B      7.1.0-rc6 #1   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x4e/0x70    print_report+0x157/0x4c9    kasan_report+0xce/0x100    kasan_check_range+0x10f/0x1e0    __asan_memcpy+0x23/0x60    kmemdup_noprof+0x36/0x50    decode_ntlmssp_challenge+0x457/0x680    SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0    SMB2_sess_setup+0x219/0x4f0    cifs_setup_session+0x248/0xaf0    cifs_get_smb_ses+0xf79/0x17e0    cifs_mount_get_session+0x7f/0x3a0    cifs_mount+0xb4/0xcf0    cifs_smb3_do_mount+0x23a/0x1500    smb3_get_tree+0x3b0/0x630    vfs_get_tree+0x82/0x2d0    fc_mount+0x10/0x1b0    path_mount+0x50d/0x1de0    __x64_sys_mount+0x20b/0x270    do_syscall_64+0xee/0x590    entry_SYSCALL_64_after_hwframe+0x77/0x7f    \u003c/TASK\u003e   Allocated by task 93:    kmem_cache_alloc_noprof+0x106/0x380    mempool_alloc_noprof+0x116/0x1e0    cifs_small_buf_get+0x31/0x80    allocate_buffers+0x10d/0x2b0    cifs_demultiplex_thread+0x1d5/0x1d50    kthread+0x2c6/0x390    ret_from_fork+0x36e/0x5a0    ret_from_fork_asm+0x1a/0x30   The buggy address is located 120 bytes inside of    allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)    which belongs to the cache cifs_small_rq of size 448  Restrict the +1 exemption to responses that have no data area, so that it still covers the bcc[0] omission it was meant for.  When a data area is present, the +1 discrepancy instead means the reported data length overruns the ---truncated---",
  "id": "DEBIAN-CVE-2026-64448",
  "modified": "2026-09-14T16:47:50.060979671Z",
  "published": "2026-07-25T10:17:29.557Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64448"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64448"
  ]
}