CVE-2026-64598

smb/client: Fix error code in smb2_aead_req_alloc()

State: Published
Severity: 8.8 High
Published: Aug 6, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: Fix error code in smb2_aead_req_alloc()

The "*num_sgs" variable is a u32 so "ERR_PTR(*num_sgs)" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler to store the return in an int ret variable.

This bug would eventually result in a crash when dereference the invalid error pointer.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before aa37f5fef78dd11cbf983269da2031e12625c56dAffected d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before cad756733dc3985188983f3e2eb77e2927209099Affected d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before a187883cc1dc784a4d32537f5d316f1b7b9ad76fAffected d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before a1cc432cb0b0a1f74f98a0db3b94ca880c7947acAffected d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before 61f28012e5650c619223decdb7970e0d3162e949Affected
LinuxLinux	6.3Affected before 6.3Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before aa37f5fef78dd11cbf983269da2031e12625c56dAffected
d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before cad756733dc3985188983f3e2eb77e2927209099Affected
d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before a187883cc1dc784a4d32537f5d316f1b7b9ad76fAffected
d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before a1cc432cb0b0a1f74f98a0db3b94ca880c7947acAffected
d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before 61f28012e5650c619223decdb7970e0d3162e949Affected

LinuxLinux

6.3Affected
before 6.3Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.