Integer overflow in Linux

CVE-2026-64598

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2_aead_req_alloc() The "*num_sgs" variable is a u32 so "ERR_PTR(*num_sgs)" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler to store the return in an int ret variable. This bug would eventually result in a crash when dereference the invalid error pointer.

Vulnerability class: Integer Overflow

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.003 (20.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 20.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-64598: held from 0.005 to 0.003.

EPSS over last 30 days · oldest: 0.005 · newest: 0.003 · change: -0.003

Affected products

  • Linux — versions 7.2-rc1, 6.6.145, 7.2

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-64598?
CVE-2026-64598 is a high-severity vulnerability in Linux, classified under Integer Overflow or Wraparound. CVSS score: 8.8/10. Published 2026-08-06.
How severe is CVE-2026-64598?
High severity. CVSS v3 base score is 8.8 out of 10.