Executive brief
A vulnerability in the Linux kernel's SMB client could allow a malicious file server to crash or compromise a connected 32-bit Linux system. When a user connects to a rogue server, the server can send specially crafted security data that causes the Linux system to miscalculate memory locations. This can lead to unauthorized memory access during common file operations like changing file permissions or ownership.
Technical details
A vulnerability exists in the Linux kernel SMB client's handling of Discretionary Access Control List (DACL) offsets within security descriptors. In the functions parse_sec_desc(), build_sec_desc(), and id_mode_to_cifs_acl(), the client adds a server-supplied 'dacloffset' to the security descriptor pointer (pntsd) without prior numerical validation. On 32-bit architectures, a malicious server can provide a large dacloffset (near U32_MAX) that causes the resulting pointer to wrap around, bypassing subsequent pointer-based bounds checks. This allows for out-of-bounds dereferencing during chmod or chown operations. The issue is resolved by implementing numerical validation of the dacloffset before pointer construction.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches (including 6.x, 5.x, 4.x)
Timeline
- 2026-04-20: other: Vulnerability fixed in source code by Michael Bommarito
- 2026-05-28: advisory: CVE-2026-46195 published by NVD
- 2026-05-14: patched: Patches merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7
- https://git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a
- https://git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505
- https://git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a
- https://git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3