Answer in brief
CVE-2026-64380 records a Unknown severity vulnerability in smb: client: harden POSIX SID length parsing. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-64380 records a Unknown severity vulnerability in smb: client: harden POSIX SID length parsing. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=349e13ad30b45998bb9937cfe0b32be6f951976d <171605aed68380c2fa75dff9b3a1ed427c50065b || >=349e13ad30b45998bb9937cfe0b32be6f951976d <4213c1208978483021d7d125c131de3985d38f61 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <96e889bc1e759c83f25093e8c2f3da31b4973f30 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <0de5b8e76847f5de26f364a82c6602c4881c30da || >=349e13ad30b45998bb9937cfe0b32be6f951976d <427eb7eb46425fec845a43e861f3d6e2899cae59 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <86c5d470f5d42e61123b2f4b4f0b91f4eee5b980 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <46a84715a015cb48e1b9c219dc88c03d8a541ea4 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <7ad2bcf2441430bb2e918fb3ef9a90d775a6e422 | 171605aed68380c2fa75dff9b3a1ed427c50065b, 4213c1208978483021d7d125c131de3985d38f61, 96e889bc1e759c83f25093e8c2f3da31b4973f30, 0de5b8e76847f5de26f364a82c6602c4881c30da, 427eb7eb46425fec845a43e861f3d6e2899cae59, 86c5d470f5d42e61123b2f4b4f0b91f4eee5b980, 46a84715a015cb48e1b9c219dc88c03d8a541ea4, 7ad2bcf2441430bb2e918fb3ef9a90d775a6e422 |
| Linux/Linuxgeneric | 5.7 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=349e13ad30b45998bb9937cfe0b32be6f951976d <171605aed68380c2fa75dff9b3a1ed427c50065b || >=349e13ad30b45998bb9937cfe0b32be6f951976d <4213c1208978483021d7d125c131de3985d38f61 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <96e889bc1e759c83f25093e8c2f3da31b4973f30 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <0de5b8e76847f5de26f364a82c6602c4881c30da || >=349e13ad30b45998bb9937cfe0b32be6f951976d <427eb7eb46425fec845a43e861f3d6e2899cae59 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <86c5d470f5d42e61123b2f4b4f0b91f4eee5b980 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <46a84715a015cb48e1b9c219dc88c03d8a541ea4 || >=349e13ad30b45998bb9937cfe0b32be6f951976d <7ad2bcf2441430bb2e918fb3ef9a90d775a6e422 | 171605aed68380c2fa75dff9b3a1ed427c50065b, 4213c1208978483021d7d125c131de3985d38f61, 96e889bc1e759c83f25093e8c2f3da31b4973f30, 0de5b8e76847f5de26f364a82c6602c4881c30da, 427eb7eb46425fec845a43e861f3d6e2899cae59, 86c5d470f5d42e61123b2f4b4f0b91f4eee5b980, 46a84715a015cb48e1b9c219dc88c03d8a541ea4, 7ad2bcf2441430bb2e918fb3ef9a90d775a6e422 |
| Linux/Linuxgeneric | 5.7 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.
Quoted source text, attributed separately from HOL analysis.