CVE-2026-46185
Received Received - Intake
Out-of-Bounds Read in Linux Kernel SMB Client

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer only contains the base SMB2 header (64 bytes), accessing err->ErrorContextCount (at offset 66) or err->ByteCount later in symlink_data() will cause an out-of-bounds read.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-05-28
AI Q&A
2026-05-28
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's SMB client code, specifically in the function symlink_data(). The issue arises because smb2_check_message() returns success without validating the length of the symlink error response. As a result, symlink_data() may attempt to read beyond the bounds of the provided buffer if the buffer is smaller than expected.

More specifically, if the buffer only contains the base SMB2 header (64 bytes), accessing fields such as ErrorContextCount or ByteCount in the error response structure will cause an out-of-bounds read, potentially leading to memory safety issues.


How can this vulnerability impact me? :

This vulnerability can lead to an out-of-bounds read in kernel memory when processing SMB symlink error responses. Such out-of-bounds reads can cause system instability, crashes, or potentially expose sensitive kernel memory contents, which may be leveraged by attackers for further exploitation.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart