Junglewise Threat Intelligence

CVE-2026-46139: Linux Kernel SMB client uninitialized memory in security descriptor

CVE-2026-46139 · Severity: info · CVSS 0 · Published 2026-05-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's SMB client could cause file permission changes (chmod) to fail when interacting with certain network storage servers. This occurs because the system sends uninitialized memory data in security requests, which servers like Samba may reject as invalid. While primarily an operational issue that can disrupt file management, it also results in the unintended leakage of small amounts of internal system memory over the network.

Technical details

A vulnerability exists in the Linux kernel SMB client's build_sec_desc() function within fs/smb/client/cifsacl.c. Following a previous change that split the num_aces field into two 16-bit fields, a 2-byte 'reserved' field (Sbz2 in MS-DTYP) was left uninitialized when using kmalloc(). This results in the field containing stale heap data. When this data is non-zero, remote servers such as Samba reject the descriptor with a 'Range Error', causing local chmod operations to fail with EINVAL. The fix replaces kmalloc() with kzalloc() to ensure the entire descriptor buffer is zero-initialized before transmission.

Affected products

  • Linux Linux Kernel 6.1.y, 6.6.y, 6.8.y, 6.9.y

Timeline

  • 2026-04-30: other: Patch authored by Bjoern Doebel
  • 2026-05-17: patched: Patch committed to stable tree
  • 2026-05-28: advisory: CVE-2026-46139 published

References

Related threats