The Linux kernel vulnerability CVE-2026-64380 involves the SMB client POSIX SID length parsing in the function posix_info_sid_size(). The function reads sid[1] to determine the subauthority count but previously allowed buffers with only one remaining byte, which is insufficient for safe parsing. This boundary check weakness could allow malformed POSIX SIDs to be processed, potentially causing denial of service. The issue was resolved by requiring at least two bytes before reading sid[1], ensuring all client paths reject truncated POSIX SIDs safely. The vulnerability affects linux-hwe-edge kernel versions prior to 7.0.0-1012.12~24.04.1 and related builds. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), indicating network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality impact but high availability impact. A patch is available from Ubuntu security notices USN-8726-1 and USN-8727-1, and users should update to the fixed kernel versions.

An attacker could exploit this vulnerability remotely without privileges or user interaction to cause a denial of service by triggering improper POSIX SID parsing in the SMB client. The confidentiality impact is limited, but availability impact is high due to potential crashes or resource exhaustion. There are no known exploits in the wild at this time.

A patch is available and should be applied promptly. Users should update their Linux kernel packages to versions 7.0.0-1012.12~24.04.1 or later as provided in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigation actions are required beyond applying the official fix.