CVE-2026-64380 is an off-by-one read in the Linux kernel's CIFS subsystem. The function posix_info_sid_size() validates the subauthority count field (sid[1]) using only one byte of boundary checking — when a truncated POSIX SID arrives, the function can read one byte past the buffer end. This yields either a kernel memory leak (1-8 bytes depending on alignment) or a crash from accessing unmapped memory.
The CVSS 8.2 reflects real impact: arbitrary kernel memory read or denial of service are possible. But the EPSS of 0.00443 tells you the exploitation path is narrow. POSIX SID parsing only activates when POSIX extensions are enabled on an SMB mount, and the attacker needs an authenticated SMB session with a peer server sending malformed SIDs. This is not a remotely triggerable bug from unauthenticated network traffic.
What you should do: First, determine whether your Samba or CIFS mounts ever enable POSIX extensions — check for 'posix' in mount options or smb.conf. Second, and more importantly, treat the detection gap as your primary concern. This is a silent read: the function likely returns a garbage size value rather than failing explicitly, leaving no obvious artifact in logs. You cannot easily distinguish between an exploitation attempt and a misbehaving CIFS client. If you run Samba as an Active Directory domain controller, your exposure is higher — mixed Unix-Windows environments are more likely to exercise the POSIX SID path.
The vulnerability was fixed by adding one byte to the boundary check. That surgical fix is itself informative: this reads like a fuzzing or audit catch, not active exploitation in the wild. Prioritize patching, but understand that exploitation would require a committed attacker with authenticated SMB access — a higher bar than most remote vulnerabilities.