CVE-2026-64381 PUBLISHED

smb: client: Fix next buffer leak in receive_encrypted_standard()

Assigner: Linux
Reserved: 19.07.2026 Published: 25.07.2026 Updated: 25.07.2026

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix next buffer leak in receive_encrypted_standard()

receive_encrypted_standard() allocates next_buffer before checking whether the number of compound PDUs already reached MAX_COMPOUND. If the limit check fails, the function returns immediately and the newly allocated next_buffer is not assigned to server->smallbuf/server->bigbuf, making it leaked.

Move the MAX_COMPOUND check before allocating next_buffer.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from b24df3e30cbf48255db866720fb71f14bf9d2f39 to 94e4f672db029414b9888b5137a7559f1febf2d8 (excl.)
  • affected from b24df3e30cbf48255db866720fb71f14bf9d2f39 to 68fc0b6cc03ca58060c0f36454e169f5fe258974 (excl.)
  • affected from b24df3e30cbf48255db866720fb71f14bf9d2f39 to 07e0ab81df1790afa35732a4e8e07ff831b29008 (excl.)
  • affected from b24df3e30cbf48255db866720fb71f14bf9d2f39 to 9136a08dc29328edd9867f2545e73906ac9df93b (excl.)
  • affected from b24df3e30cbf48255db866720fb71f14bf9d2f39 to 67097772df7791c53d608f04bd31c676ccf79b83 (excl.)
  • affected from b24df3e30cbf48255db866720fb71f14bf9d2f39 to 297243e365fc9fe2f8e9b7dd535a65d922cd108b (excl.)
  • affected from b24df3e30cbf48255db866720fb71f14bf9d2f39 to 927d4805aea0a287d36dd4f826ee24d69a2afee3 (excl.)
  • affected from b24df3e30cbf48255db866720fb71f14bf9d2f39 to 1c6267a1d5cf4c73b656f8181b310cbbb3e4767b (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 4.19 is affected
  • unaffected from 0 to 4.19 (excl.)
  • unaffected from 5.10.261 to 5.10.* (incl.)
  • unaffected from 5.15.212 to 5.15.* (incl.)
  • unaffected from 6.1.178 to 6.1.* (incl.)
  • unaffected from 6.6.145 to 6.6.* (incl.)
  • unaffected from 6.12.96 to 6.12.* (incl.)
  • unaffected from 6.18.39 to 6.18.* (incl.)
  • unaffected from 7.1.4 to 7.1.* (incl.)
  • unaffected from 7.2-rc1 to * (incl.)

References