PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46139 Linux CVE debrief

A vulnerability in the Linux kernel's SMB client implementation could cause chmod operations to fail against Samba servers when setting security descriptors. The issue stems from uninitialized heap memory in the reserved field of struct smb_acl, introduced when a prior commit split the num_aces field from 32-bit to 16-bit with a 16-bit reserved field. The build_sec_desc() function used kmalloc() without zeroing the buffer, leaving the Sbz2 field (which must be zero per MS-DTYP specification) containing slab garbage. When this garbage is non-zero, Samba rejects the security descriptor with a range error, causing EINVAL on chmod. The fix replaces kmalloc() with kzalloc() to ensure zero-initialization.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-24
Advisory published
2026-05-28
Advisory updated
2026-06-24

Who should care

Organizations using Linux systems with SMB/CIFS client mounts to Samba servers, particularly those performing permission modifications (chmod) on SMB shares. System administrators managing Linux kernel deployments and security teams tracking kernel-level SMB protocol implementation vulnerabilities.

Technical summary

The Linux kernel's SMB client build_sec_desc() function allocated security descriptor buffers using kmalloc() without zero-initialization. Following a structure change that introduced a 16-bit reserved field in struct smb_acl, this reserved field (corresponding to Sbz2 in MS-DTYP ACL wire format) could contain uninitialized heap data. When non-zero, Samba servers reject the security descriptor with 'ndr_pull_security_descriptor failed: Range Error', causing chmod to return EINVAL. The fix uses kzalloc() to ensure zero-initialization of the entire buffer.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor NVD for CVSS scoring once analysis is complete
  • Verify SMB client functionality with Samba servers after patching, particularly chmod operations on SMB shares
  • Review custom kernel builds using SMB client code for proper initialization of security descriptor buffers

Evidence notes

The vulnerability description indicates this was resolved in the Linux kernel SMB client code. The issue was introduced by commit 62e7dd0a39c2d which changed struct smb_acl's data types. Multiple stable kernel commits are referenced as fixes. No CVSS score or severity is currently assigned by NVD (status: Awaiting Analysis).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46139 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46139

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46139 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46139

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4c3ed344a970aad51388ac3b0145b98318f0e21f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5e489c6c47a2ac15edbaca153b9348e42c1eacab

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/941a1e6eb35440336913afc88a82103291956d5d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9bdb2ca31368b7671949dfb94a5d57ffccd01edd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/be1ef9512a3f5a755895c24f31b334342f4aa15b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.