PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46155 Linux CVE debrief

A vulnerability in the Linux kernel's SMB client implementation allows an out-of-bounds read that can leak adjacent kernel heap memory. The flaw exists in smb2_compound_op() where a malicious SMB server can send a truncated response with a large OutputBufferLength value. The check_wsl_eas() function returns success without validating that OutputBufferLength fits within the actual iov_len of the response buffer. Subsequently, smb2_compound_op() performs a memcpy using size[0] (the untrusted OutputBufferLength) as the copy size, reading beyond the allocated rsp_iov buffer boundary. This represents an information disclosure vulnerability where kernel heap memory contents can be leaked to an attacker-controlled SMB server. The vulnerability affects systems using the kernel's SMB client (cifs/smbfs) to connect to untrusted or compromised SMB servers.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-09
Advisory published
2026-05-28
Advisory updated
2026-06-09

Who should care

Organizations running Linux systems with SMB client mounts, particularly those connecting to external or multi-tenant SMB services. Cloud environments using SMB for file storage integration. Security teams monitoring for kernel information disclosure vulnerabilities that could facilitate further exploitation.

Technical summary

The vulnerability stems from insufficient validation of server-provided length fields in the SMB2 compound operation handler. When processing Windows Symbolic Link (WSL) extended attributes, check_wsl_eas() validates EA list termination but fails to verify that OutputBufferLength does not exceed the actual response buffer size (iov_len). This validation gap allows a malicious SMB server to specify an OutputBufferLength larger than the allocated rsp_iov, causing smb2_compound_op() to read beyond buffer boundaries during memcpy operations. The leaked memory may contain sensitive kernel data structures, cryptographic material, or other privileged information from the kernel heap.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates from stable branches once patches are available for your distribution
  • Restrict SMB client connections to trusted servers only
  • Monitor for anomalous SMB server behavior that could indicate exploitation attempts
  • Consider network segmentation to isolate SMB client systems from untrusted networks

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-28. Root cause confirmed in kernel commit messages resolving the out-of-bounds read in smb2_compound_op(). Multiple stable kernel branch fixes identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46155 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46155

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46155 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46155

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/512d33bc8ea4ea5c19728ee118715f4b1f4d1926

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8d09328dfda089675e4c049f3f256064a1d1996b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9b3af35645ff9cd334edc130249f9a2fb2bea25f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dffb44b2e06a2908e249f0f93156fc987eee1d1c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.