CVE-2026-46155

smb/client: fix out-of-bounds read in smb2_compound_op()

State: Published
Severity: 9.1 Critical
Published: May 28, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix out-of-bounds read in smb2_compound_op()

If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len.

Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]);

Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	7449d736bbbd160c76b01b8fcdf72f58a8757d4b to before dffb44b2e06a2908e249f0f93156fc987eee1d1cAffected ea41367b2a602f602ea6594fc4a310520dcc64f4 to before 9b3af35645ff9cd334edc130249f9a2fb2bea25fAffected ea41367b2a602f602ea6594fc4a310520dcc64f4 to before 512d33bc8ea4ea5c19728ee118715f4b1f4d1926Affected ea41367b2a602f602ea6594fc4a310520dcc64f4 to before a16f70a71be4b5a4eccf39a9bf09b47285f4cb7cAffected ea41367b2a602f602ea6594fc4a310520dcc64f4 to before 8d09328dfda089675e4c049f3f256064a1d1996bAffected 6.6.32 to before 6.6.140Affected
LinuxLinux	6.9Affected before 6.9Not affected 6.6.140 through 6.6.Not affected 6.12.88 through 6.12.Not affected 6.18.30 through 6.18.Not affected 7.0.7 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

7449d736bbbd160c76b01b8fcdf72f58a8757d4b to before dffb44b2e06a2908e249f0f93156fc987eee1d1cAffected
ea41367b2a602f602ea6594fc4a310520dcc64f4 to before 9b3af35645ff9cd334edc130249f9a2fb2bea25fAffected
ea41367b2a602f602ea6594fc4a310520dcc64f4 to before 512d33bc8ea4ea5c19728ee118715f4b1f4d1926Affected
ea41367b2a602f602ea6594fc4a310520dcc64f4 to before a16f70a71be4b5a4eccf39a9bf09b47285f4cb7cAffected
ea41367b2a602f602ea6594fc4a310520dcc64f4 to before 8d09328dfda089675e4c049f3f256064a1d1996bAffected
6.6.32 to before 6.6.140Affected

LinuxLinux

6.9Affected
before 6.9Not affected
6.6.140 through 6.6.*Not affected
6.12.88 through 6.12.*Not affected
6.18.30 through 6.18.*Not affected
7.0.7 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.