CVE-2026-64578

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: validate compound request size before reading StructureSize2<br /> <br /> When ksmbd validates a compound (chained) SMB2 request,<br /> ksmbd_smb2_check_message() reads pdu-&gt;StructureSize2 without first<br /> checking that the compound element is large enough to contain it.<br /> StructureSize2 is a 2-byte field at offset 64<br /> (__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element.<br /> <br /> The compound-walking logic only guarantees that a full 64-byte SMB2<br /> header is present for the trailing element: when NextCommand is 0, len is<br /> reduced to the number of bytes remaining after next_smb2_rcv_hdr_off. A<br /> remote client can craft a compound request whose last element has exactly<br /> 64 bytes, so the 2-byte StructureSize2 read at offset 64 extends one byte<br /> past the receive buffer, producing a slab-out-of-bounds read.<br /> <br /> BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)<br /> Read of size 2 at addr ffff888012ae31ac by task kworker/0:1/14<br /> The buggy address is located 172 bytes inside of allocated 173-byte region<br /> Workqueue: ksmbd-io handle_ksmbd_work<br /> Call Trace:<br /> ...<br /> kasan_report (mm/kasan/report.c:595)<br /> ksmbd_smb2_check_message (fs/smb/server/smb2misc.c:402)<br /> handle_ksmbd_work (fs/smb/server/server.c:119)<br /> process_one_work (kernel/workqueue.c:3314)<br /> worker_thread (kernel/workqueue.c:3397)<br /> kthread (kernel/kthread.c:436)<br /> ret_from_fork (arch/x86/kernel/process.c:158)<br /> ret_from_fork_asm (arch/x86/entry/entry_64.S:245)<br /> <br /> Reject any compound element that is too small to hold StructureSize2<br /> before dereferencing it.