PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46155 Linux CVE debrief

A vulnerability in the Linux kernel's SMB client implementation allows an out-of-bounds read that can leak adjacent kernel heap memory. The flaw exists in smb2_compound_op() where a malicious SMB server can send a truncated response with a large OutputBufferLength value. The check_wsl_eas() function returns success without validating that OutputBufferLength fits within the actual iov_len of the response buffer. Subsequently, smb2_compound_op() performs a memcpy using size[0] (the untrusted OutputBufferLength) as the copy size, reading beyond the allocated rsp_iov buffer boundary. This represents an information disclosure vulnerability where kernel heap memory contents can be leaked to an attacker-controlled SMB server. The vulnerability affects systems using the kernel's SMB client (cifs/smbfs) to connect to untrusted or compromised SMB servers.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Organizations running Linux systems with SMB client mounts, particularly those connecting to external or multi-tenant SMB services. Cloud environments using SMB for file storage integration. Security teams monitoring for kernel information disclosure vulnerabilities that could facilitate further exploitation.

Technical summary

The vulnerability stems from insufficient validation of server-provided length fields in the SMB2 compound operation handler. When processing Windows Symbolic Link (WSL) extended attributes, check_wsl_eas() validates EA list termination but fails to verify that OutputBufferLength does not exceed the actual response buffer size (iov_len). This validation gap allows a malicious SMB server to specify an OutputBufferLength larger than the allocated rsp_iov, causing smb2_compound_op() to read beyond buffer boundaries during memcpy operations. The leaked memory may contain sensitive kernel data structures, cryptographic material, or other privileged information from the kernel heap.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates from stable branches once patches are available for your distribution
  • Restrict SMB client connections to trusted servers only
  • Monitor for anomalous SMB server behavior that could indicate exploitation attempts
  • Consider network segmentation to isolate SMB client systems from untrusted networks

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-28. Root cause confirmed in kernel commit messages resolving the out-of-bounds read in smb2_compound_op(). Multiple stable kernel branch fixes identified.

Official resources

2026-05-28