PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46185 Linux CVE debrief

A vulnerability in the Linux kernel's SMB client implementation could allow an out-of-bounds read when processing malformed symbolic link error responses. The issue stems from insufficient length validation in the `smb2_check_message()` function, which returns success without verifying the response length for symlink error responses. Subsequently, in `symlink_data()`, the code accesses fields at offsets 66 and beyond (specifically `ErrorContextCount` and `ByteCount` within `struct smb2_err_rsp`) without confirming that the buffer contains sufficient data beyond the 64-byte SMB2 header. If a malicious or malformed server provides a response containing only the base SMB2 header, this results in reading memory beyond the allocated buffer boundary. The vulnerability affects the kernel's CIFS/SMB3 client subsystem and has been resolved through patches to multiple stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-11
Advisory published
2026-05-28
Advisory updated
2026-06-11

Who should care

Organizations running Linux systems with SMB/CIFS client functionality enabled, particularly those mounting shares from potentially untrusted or compromised servers. System administrators responsible for kernel security patching and network file system configurations should prioritize this update.

Technical summary

The vulnerability exists in the SMB client (`smb/client`) subsystem of the Linux kernel. The `smb2_check_message()` function fails to perform length validation specifically for symlink error responses, returning success regardless of actual buffer size. The `symlink_data()` function then assumes sufficient buffer length and accesses `struct smb2_err_rsp` fields at offsets that may exceed the actual `iov->iov_len`. With a minimal 64-byte SMB2 header response, accesses to `ErrorContextCount` (offset 66) and `ByteCount` cause out-of-bounds memory reads. The fix adds appropriate length validation before field access.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from the relevant stable branches once patches are available through distribution channels
  • Monitor kernel security advisories from your Linux distribution for specific package updates
  • Consider restricting SMB client connections to trusted servers until patches are deployed
  • Review SMB client configurations for systems processing symbolic links from untrusted network sources

Evidence notes

The vulnerability description indicates that `smb2_check_message()` lacks length validation for symlink error responses, and `symlink_data()` subsequently accesses `err->ErrorContextCount` at offset 66 and `err->ByteCount` without bounds checking. The fix commits referenced in the source material address this validation gap.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46185 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46185

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46185 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46185

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/15dc0a4de743a1aaa7b859b3aea79f08c695396c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b8c8a704f0bc133deb171f6aeb6f3a684203e212

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b9561402489d41149f63e001a74384863b7b30a6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d62b8d236fab503c6fec1d3e9a38bea71feaca20

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ef6495d4df6e7af8f3de67e65150881c880f696c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.