This vulnerability (CVE-2026-64257) is a validation bypass in the Linux kernel's SMB2 response parser. A prior security fix added an exemption allowing responses where bcc[0] is zero to pass validation — treating them as legacy responses without a data area. However, the overlap handler (which processes fragmented SMB2 responses) clears the data_length field as a side effect. When this happens, __smb2_calc_size() misinterprets the malformed response as one lacking a data area entirely, and the bcc[0] exemption fires inappropriately. The attacker-controlled response bypasses validation checks and enters subsequent handler logic that expects well-formed data structures.
Check your kernel version against the patch commit. If you cannot immediately patch, restrict SMB client traffic to trusted networks — the attack requires either a MITM position or the ability to send SMB2 responses to the target (including via malicious server connections from the target machine). This is a kernel code path that executes before filesystem locks or SELinux policies are fully engaged, which elevates the practical risk beyond what a simple validation bypass might suggest.
The deeper lesson: data_length was repurposed as an implicit signal (indicating "no data area present") while another code path used it for a different purpose (tracking overlap state). This shared state created an interaction neither branch explicitly modeled. Future audits should trace every protocol field used as a precondition in security exceptions and verify that no other code path modifies that field for side effects. The kernel's SMB parsing code has accumulated similar implicit-state dependencies before — treat this as a pattern to hunt, not a one-off.