PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46185 Linux CVE debrief

A vulnerability in the Linux kernel's SMB client implementation could allow an out-of-bounds read when processing malformed symbolic link error responses. The issue stems from insufficient length validation in the `smb2_check_message()` function, which returns success without verifying the response length for symlink error responses. Subsequently, in `symlink_data()`, the code accesses fields at offsets 66 and beyond (specifically `ErrorContextCount` and `ByteCount` within `struct smb2_err_rsp`) without confirming that the buffer contains sufficient data beyond the 64-byte SMB2 header. If a malicious or malformed server provides a response containing only the base SMB2 header, this results in reading memory beyond the allocated buffer boundary. The vulnerability affects the kernel's CIFS/SMB3 client subsystem and has been resolved through patches to multiple stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Organizations running Linux systems with SMB/CIFS client functionality enabled, particularly those mounting shares from potentially untrusted or compromised servers. System administrators responsible for kernel security patching and network file system configurations should prioritize this update.

Technical summary

The vulnerability exists in the SMB client (`smb/client`) subsystem of the Linux kernel. The `smb2_check_message()` function fails to perform length validation specifically for symlink error responses, returning success regardless of actual buffer size. The `symlink_data()` function then assumes sufficient buffer length and accesses `struct smb2_err_rsp` fields at offsets that may exceed the actual `iov->iov_len`. With a minimal 64-byte SMB2 header response, accesses to `ErrorContextCount` (offset 66) and `ByteCount` cause out-of-bounds memory reads. The fix adds appropriate length validation before field access.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from the relevant stable branches once patches are available through distribution channels
  • Monitor kernel security advisories from your Linux distribution for specific package updates
  • Consider restricting SMB client connections to trusted servers until patches are deployed
  • Review SMB client configurations for systems processing symbolic links from untrusted network sources

Evidence notes

The vulnerability description indicates that `smb2_check_message()` lacks length validation for symlink error responses, and `symlink_data()` subsequently accesses `err->ErrorContextCount` at offset 66 and `err->ByteCount` without bounds checking. The fix commits referenced in the source material address this validation gap.

Official resources

2026-05-28