CVE-2026-64380: linux Out-of-bounds Read
Vulnerability summary
CVE-2026-64380 is a high (CVSS 8.2) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 27 · Related 27Timeline
- 25-07-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu157 products
- linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-147.147 | < 7.0.0-31.31
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1067.70 | < 7.0.0-1012.12
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.180-1 | < 6.12.96-1 | < 7.1.4-1
- linux-6.12< 6.12.100-1~deb12u1
Linux2 products
- linux≥ 349e13ad30b45998bb9937cfe0b32be6f951976d, < 171605aed68380c2fa75dff9b3a1ed427c50065b | ≥ 349e13ad30b45998bb9937cfe0b32be6f951976d, < 4213c1208978483021d7d125c131de3985d38f61 | ≥ 349e13ad30b45998bb9937cfe0b32be6f951976d, < 96e889bc1e759c83f25093e8c2f3da31b4973f30 | ≥ 349e13ad30b45998bb9937cfe0b32be6f951976d, < 0de5b8e76847f5de26f364a82c6602c4881c30da | ≥ 349e13ad30b45998bb9937cfe0b32be6f951976d, < 427eb7eb46425fec845a43e861f3d6e2899cae59 | ≥ 349e13ad30b45998bb9937cfe0b32be6f951976d, < 86c5d470f5d42e61123b2f4b4f0b91f4eee5b980 | ≥ 349e13ad30b45998bb9937cfe0b32be6f951976d, < 46a84715a015cb48e1b9c219dc88c03d8a541ea4 | ≥ 349e13ad30b45998bb9937cfe0b32be6f951976d, < 7ad2bcf2441430bb2e918fb3ef9a90d775a6e422 | 5.7
- linux_kernel≥ 5.7, < 5.10.261 | ≥ 5.11, < 5.15.212 | ≥ 5.16, < 6.1.178 | ≥ 6.2, < 6.6.145 | ≥ 6.7, < 6.12.96 | ≥ 6.13, < 6.18.39 | ≥ 6.19, < 7.1.4 | 7.2:rc1
3 vendors · 161 products
