smb: client: validate dacloffset before building DACL pointers

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-46195
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-28 10:16:35 UTC
Updated2026-07-15 02:22:12 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returned security descriptor. On 32-bit builds a malicious server can return dacloffset near U32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip past the later pointer-based bounds checks. build_sec_desc() and id_mode_to_cifs_acl() can then dereference DACL fields from the wrapped pointer in the chmod/chown rewrite paths. Validate dacloffset numerically before building any DACL pointer and reuse the same helper at the three DACL entry points.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from ADP

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.000600000 probability, percentile 0.190830000 (date 2026-06-03)

Problem Types: CWE-476 | CWE-787 | CWE-787 Out-of-bounds Write

VersionSourceTypeScoreSeverityVector
3.1ADPCVSS7.5HIGHCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.10b0ca135-0b70-47e7-9f44-1890c2a1c46cSecondary7.5HIGHCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 5de2665e913a10ad70aaeecf736b97276e83d995 git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 f9dc3be8f403c1216df73e57221f44b045e7ee0b git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 ba7f71b6161c0943dafc367565e5843d16b7d505 git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 3b1ddba19e77ee35241cd27f16dc3e8d14e08db7 git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 c688f3ed73d31943334ad2139cb02ec49664322a git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 8bd07e417b6bda67e317920584e48cb6ee442a8a git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 f98b48151cc502ada59d9778f0112d21f2586ca3 git Not specified
CNA Linux Linux affected 5.12 Not specified
CNA Linux Linux unaffected 5.12 semver Not specified
CNA Linux Linux unaffected 5.15.210 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.140 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.88 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.30 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.7 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified
ADP Red Hat Red Hat Enterprise Linux 8 unaffected 0:4.18.0-553.126.1.rt7.467.el8_10 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8 unaffected 0:4.18.0-553.126.1.el8_10 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9 unaffected 0:5.14.0-687.12.1.el9_8 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 10 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 6 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 7 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 7 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9 Not specified Not specified

References

ReferenceSourceLinkTags
access.redhat.com/errata/RHSA-2026:21706 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
access.redhat.com/errata/RHSA-2026:21556 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/5de2665e913a10ad70aaeecf736b97276e83d995 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
bugzilla.redhat.com/show_bug.cgi 0b0ca135-0b70-47e7-9f44-1890c2a1c46c bugzilla.redhat.com
access.redhat.com/errata/RHSA-2026:21745 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/f9dc3be8f403c1216df73e57221f44b045e7ee0b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
access.redhat.com/security/cve/CVE-2026-46195 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46195.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c security.access.redhat.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Additional Advisory Data

SourceTimeEvent
ADP2026-05-28T00:00:00.000ZReported to Red Hat.
ADP2026-05-28T00:00:00.000ZMade public.

Solutions

ADP: RHSA-2026:21556: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)

ADP: RHSA-2026:21706: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)

ADP: RHSA-2026:21745: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)

Workarounds

ADP: To mitigate this issue, avoid mounting shares from untrusted SMB servers on 32-bit Red Hat Enterprise Linux systems. If interaction with untrusted SMB servers is unavoidable, consider isolating affected systems or restricting network access to only known, trusted SMB servers.

© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report