CVE-2026-46139
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A vulnerability has been identified in the Linux kernel SMB client related to improper initialization of the security descriptor buffer. A change in the data structure caused the reserved field to remain uninitialized, leading to errors when attempting to use chmod.
Risk Assessment
Improper buffer initialization may lead to Samba rejecting the security descriptor, resulting in file operation errors. This can affect system availability and security.
Recommendation
It is recommended to update the Linux kernel to use kzalloc instead of kmalloc, ensuring proper zero-initialization of the buffer.
Other vulnerabilities in Linux kernel SMB client
See all- CVE-2026-89637Unknown
In the Linux kernel SMB client, cifs_check_trans2() returning false for a malformed secondary T2 response (invalid SMB header or PDU rejected by check2ndT2()) causes handle_mid() to overwrite mid->resp_buf with the new buffer, leaking the primary buffer and leaving server->smallbuf/bigbuf dangling. This results in a use-after-free when the demux thread reuses the freed buffer.
- CVE-2026-89636Unknown
In the Linux kernel SMB client, free_tgts() frees all structures in ce->tlist but leaves ce->tgthint pointing to one of the freed cache_dfs_tgt structures. If the pointer is not reset before later use, a use-after-free occurs.
- CVE-2026-89634Unknown
In the Linux kernel SMB client, the ALIGN() macro in symlink_data() can overflow for ErrorDataLength values near UINT32_MAX (e.g. 0xFFFFFFF9), wrapping to 0. This causes the bounds check to pass and the loop to advance by zero bytes, leaving pointer 'p' pointing into stale data.
- CVE-2026-89633Unknown
In the Linux kernel SMB client, coalesce_t2() computes data pointers directly from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area and overwrite header fields, while a large one can push it past the buffer end, causing out-of-bounds heap reads or writes.
- CVE-2026-89632Unknown
In the Linux kernel SMB client, reparse_buf_ptr() reads the ReparseDataLength field before verifying that the received data covers the full fixed header. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data.
- CVE-2026-89631Unknown
In the Linux kernel SMB client, CIFSTCon() bounds its strnlen() by the server's ByteCount minus two, which for ByteCount 0 or 1 becomes negative as an int and converts to a huge size_t. The later subtraction wraps __u16 bytes_left, allowing cifs_strndup_from_utf16() to read up to 65535 bytes from a ~16 KB object, leaking data through /proc/fs/cifs/DebugData.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16") split struct smb_acl's __le32 num_aces field into __le16 num_aces and __le16 reserved. The reserved field corresponds to Sbz2 in the MS-DTYP ACL wire format, which must be zero [1]. When building an ACL descriptor in build_sec_desc(), we are using a kmalloc()'ed descriptor buffer and writing the fields explicitly using le16() writes now. This never writes to the 2 byte reserved field, leaving it as uninitialized heap data. When the reserved field happens to contain non-zero slab garbage, Samba rejects the security descriptor with "ndr_pull_security_descriptor failed: Range Error", causing chmod to fail with EINVAL. Change kmalloc() to kzalloc() to ensure the entire buffer is zero-initialized. [1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428