Home

Description

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.

PUBLISHED Reserved 2026-05-13 | Published 2026-05-28 | Updated 2026-05-30 | Assigner Linux




CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Product status

Default status
unaffected

7449d736bbbd160c76b01b8fcdf72f58a8757d4b (git) before dffb44b2e06a2908e249f0f93156fc987eee1d1c
affected

ea41367b2a602f602ea6594fc4a310520dcc64f4 (git) before 9b3af35645ff9cd334edc130249f9a2fb2bea25f
affected

ea41367b2a602f602ea6594fc4a310520dcc64f4 (git) before 512d33bc8ea4ea5c19728ee118715f4b1f4d1926
affected

ea41367b2a602f602ea6594fc4a310520dcc64f4 (git) before a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c
affected

ea41367b2a602f602ea6594fc4a310520dcc64f4 (git) before 8d09328dfda089675e4c049f3f256064a1d1996b
affected

6.6.32 (semver) before 6.6.140
affected

Default status
affected

6.9
affected

Any version before 6.9
unaffected

6.6.140 (semver)
unaffected

6.12.88 (semver)
unaffected

6.18.30 (semver)
unaffected

7.0.7 (semver)
unaffected

7.1-rc3 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/dffb44b2e06a2908e249f0f93156fc987eee1d1c

git.kernel.org/...c/9b3af35645ff9cd334edc130249f9a2fb2bea25f

git.kernel.org/...c/512d33bc8ea4ea5c19728ee118715f4b1f4d1926

git.kernel.org/...c/a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c

git.kernel.org/...c/8d09328dfda089675e4c049f3f256064a1d1996b

cve.org (CVE-2026-46155)

nvd.nist.gov (CVE-2026-46155)

Download JSON