CVE-2026-46155
Awaiting Analysis Awaiting Analysis - Queue
Out-of-Bounds Read in Linux Kernel SMB Client

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-05-28
AI Q&A
2026-05-28
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's SMB client implementation, specifically in the smb2_compound_op() function. When a server sends a truncated response but indicates a large OutputBufferLength and ends the EA list early, the function check_wsl_eas() incorrectly returns success without verifying that the entire OutputBufferLength fits within the allocated buffer length (iov_len).

As a result, smb2_compound_op() performs a memcpy operation using OutputBufferLength as the size, which can cause it to read beyond the allocated buffer. This out-of-bounds read can lead to leaking adjacent kernel heap memory.


How can this vulnerability impact me? :

This vulnerability can lead to the leakage of sensitive kernel heap memory due to an out-of-bounds read. An attacker controlling the server response could exploit this to access unintended memory areas, potentially exposing sensitive information stored in kernel memory.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart