CVE-2026-64598: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64598 is a denial-of-service vulnerability in the Linux kernel's SMB client module (smb/client), specifically in the smb2_aead_req_alloc() function. The bug stems from incorrect error code handling where ERR_PTR(*num_sgs) is called on a u32 variable, producing an invalid error pointer that is later dereferenced, causing a kernel crash. The vulnerability was published on August 6, 2026, and affects Linux kernel versions from 6.3 up to (but not including) the fixed releases. Fixed versions include 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. A CVSS base score has not been formally assigned; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is improper error handling (CWE-703 / incorrect type usage) in smb2_aead_req_alloc() within the Linux kernel's SMB2 client code. The *num_sgs variable is typed as u32, but the code incorrectly passes it directly to ERR_PTR(), which expects a long-compatible signed integer. This produces a nonsensical error pointer value that, when subsequently dereferenced by the caller, triggers a kernel NULL or invalid pointer dereference and crash. The fix involves storing the return value in a properly typed int ret variable before passing it to ERR_PTR(), consistent with how similar error paths are handled elsewhere in the same function (GitHub Advisory).

Successful exploitation results in a kernel crash (panic), causing a denial of service on the affected Linux system. The impact is limited to availability — confidentiality and integrity are not directly affected. A local user with the ability to trigger SMB client operations (e.g., mounting SMB shares) can crash the kernel, potentially disrupting all services running on the host (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability requires local access to trigger SMB client operations, limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

Update the Linux kernel to a patched version: 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1 and later. The corresponding upstream fix commits are aa37f5fef78d, cad756733dc3, a187883cc1dc, a1cc432cb0b0, and 61f28012e565. If immediate patching is not possible, restrict SMB client mount operations to trusted users to reduce exposure (GitHub Advisory, Feedly).