CVE-2026-46195
Buffer Overflow in Linux Kernel SMB Client
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's SMB client code where the server-supplied 'dacloffset' value is not properly validated before being used to build pointers to Discretionary Access Control List (DACL) entries.
Specifically, functions like parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() add the 'dacloffset' to a pointer before checking if the resulting DACL header fits inside the security descriptor.
On 32-bit systems, a malicious server can supply a 'dacloffset' value near the maximum 32-bit unsigned integer (U32_MAX), causing pointer arithmetic to wrap around and bypass bounds checks. This allows the kernel to dereference invalid or maliciously crafted DACL fields during chmod or chown operations.
The fix involves validating the 'dacloffset' numerically before building any DACL pointer and reusing this validation helper in all three affected code paths.
How can this vulnerability impact me? :
This vulnerability can allow a malicious SMB server to cause the Linux kernel to dereference invalid memory pointers during permission-related operations like chmod or chown.
On affected 32-bit systems, this could lead to kernel memory corruption, potentially causing system crashes, denial of service, or even privilege escalation if exploited successfully.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by validating the dacloffset numerically before building any DACL pointer and reusing the same helper at the three DACL entry points in the Linux kernel SMB client code.
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.