{"id":4654,"date":"2026-09-04T18:46:40","date_gmt":"2026-09-04T10:46:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64578"},"modified":"2026-09-04T18:46:40","modified_gmt":"2026-09-04T10:46:40","slug":"cve-2026-64578","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64578","title":{"rendered":"CVE-2026-64578 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate compo"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ksmbd: validate compound request size before reading StructureSize2<\/p>\n<p>When ksmbd validates a compound (chained) SMB2 request,<br \/>\nksmbd_smb2_check_message() reads pdu-&gt;StructureSize2 without first<br \/>\nchecking that the compound element is large enough to contain it.<br \/>\nStructureSize2 is a 2-byte field at offset 64<br \/>\n(__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.<\/p>\n<p>The compound-walking logic only guarantees that a full 64-byte SMB2<br \/>\nheader is present for the trailing element: when NextCommand is 0, len is<br \/>\nreduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A<br \/>\nremote client can craft a compound request whose last element has exactly<br \/>\n64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte<br \/>\npast the receive buffer, producing a slab-out-of-bounds read.<\/p>\n<p>  BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs\/smb\/server\/smb2misc.c:402)<br \/>\n  Read of size 2 at addr ffff888012ae31ac by task kworker\/0:1\/14<br \/>\n  The buggy address is located 172 bytes inside of allocated 173-byte region<br \/>\n  Workqueue: ksmbd-io handle_ksmbd_work<br \/>\n  Call Trace:<br \/>\n   &#8230;<br \/>\n   kasan_report (mm\/kasan\/report.c:595)<br \/>\n   ksmbd_smb2_check_message (fs\/smb\/server\/smb2misc.c:402)<br \/>\n   handle_ksmbd_work (fs\/smb\/server\/server.c:119)<br \/>\n   process_one_work (kernel\/workqueue.c:3314)<br \/>\n   worker_thread (kernel\/workqueue.c:3397)<br \/>\n   kthread (kernel\/kthread.c:436)<br \/>\n   ret_from_fork (arch\/x86\/kernel\/process.c:158)<br \/>\n   ret_from_fork_asm (arch\/x86\/entry\/entry_64.S:245)<\/p>\n<p>Reject any compound element that is too small to hold StructureSize2<br \/>\nbefore dereferencing it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ksmbd: validate compound request size before reading StructureSize2<\/p>\n<p>When ksmbd validates a compound (chained) SMB2 request,<br \/>\nksmbd_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4654","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}