PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46195 Linux CVE debrief

This CVE addresses an integer overflow vulnerability in the Linux kernel's SMB client implementation. The flaw exists in how the kernel parses security descriptors from SMB servers, specifically in the handling of the DACL (Discretionary Access Control List) offset field. On 32-bit systems, a malicious SMB server can supply a dacloffset value near U32_MAX that causes pointer arithmetic to wrap below the valid buffer bounds. This bypasses subsequent bounds checks and leads to out-of-bounds memory access when the kernel dereferences DACL fields during chmod/chown operations. The vulnerability affects three code paths: parse_sec_desc(), build_sec_desc(), and id_mode_to_cifs_acl(). The fix validates dacloffset numerically before constructing any DACL pointer and consolidates this validation into a shared helper function. This is a server-side attack vector requiring an attacker-controlled or compromised SMB server, with impact limited to 32-bit kernel builds.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-15
Advisory published
2026-05-28
Advisory updated
2026-07-15

Who should care

Organizations running 32-bit Linux systems that mount SMB/CIFS shares, particularly from external or untrusted sources; Linux distribution maintainers; security teams tracking kernel vulnerabilities in network filesystem implementations

Technical summary

The Linux kernel's SMB/CIFS client code fails to validate the dacloffset field from server-supplied security descriptors before using it in pointer arithmetic. On 32-bit architectures, a malicious server can return a dacloffset near U32_MAX, causing the derived DACL pointer to wrap below the end_of_acl boundary. This bypasses bounds checks in parse_sec_desc(), build_sec_desc(), and id_mode_to_cifs_acl(), leading to out-of-bounds memory access when DACL fields are dereferenced during permission changes. The fix introduces numerical validation of dacloffset prior to pointer construction and consolidates this check across all three affected entry points.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates from stable branches once patches are available for your distribution
  • Prioritize patching 32-bit Linux systems that mount SMB/CIFS shares from untrusted or external servers
  • Consider restricting SMB client access to trusted internal servers only as a temporary mitigation
  • Monitor for kernel security updates from your Linux distribution vendor

Evidence notes

Vulnerability description confirms integer overflow in dacloffset handling on 32-bit builds. Five kernel.org stable branch commits provided as references. No CVSS score assigned; NVD status is 'Awaiting Analysis'. No KEV listing. Vendor identified as Linux kernel based on source references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46195 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46195

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46195 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46195

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.