Executive brief
A memory leak vulnerability was identified in the Linux kernel's SMB client component, which handles file sharing and network communication with Windows-compatible servers. When processing certain encrypted network responses, the system could fail to properly release memory buffers if a specific limit on combined data packets was exceeded. Over time, this could lead to system instability or performance degradation as available memory is exhausted.
Technical details
A memory leak exists in the Linux kernel SMB client (cifs.ko) within the receive_encrypted_standard() function in fs/smb/client/smb2ops.c. The function allocates 'next_buffer' before validating if the number of compound Protocol Data Units (PDUs) has reached the MAX_COMPOUND limit. If this limit is exceeded, the function returns an error immediately without freeing the newly allocated buffer or assigning it to the server structures, resulting in a kernel memory leak. An attacker or a malicious SMB server could potentially trigger this leak repeatedly to cause a denial-of-service condition via memory exhaustion. The fix involves reordering the logic to perform the MAX_COMPOUND check prior to buffer allocation.
Affected products
- Linux Linux 4.19 to 6.13
Timeline
- 2026-06-23: other: Vulnerability fixed by developer Haoxiang Li
- 2026-07-24: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-07-25: disclosed: CVE-2026-64381 published
References
- https://git.kernel.org/stable/c/07e0ab81df1790afa35732a4e8e07ff831b29008
- https://git.kernel.org/stable/c/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b
- https://git.kernel.org/stable/c/297243e365fc9fe2f8e9b7dd535a65d922cd108b
- https://git.kernel.org/stable/c/67097772df7791c53d608f04bd31c676ccf79b83
- https://git.kernel.org/stable/c/68fc0b6cc03ca58060c0f36454e169f5fe258974
- https://git.kernel.org/stable/c/9136a08dc29328edd9867f2545e73906ac9df93b
- https://git.kernel.org/stable/c/927d4805aea0a287d36dd4f826ee24d69a2afee3