CVE-2026-46139 Overview
CVE-2026-46139 is a Linux kernel vulnerability in the SMB client code path that builds security descriptors. The build_sec_desc() function allocated its descriptor buffer with kmalloc() and then wrote individual fields explicitly, never initializing the 2-byte reserved field introduced when num_aces was split into __le16 num_aces and __le16 reserved. The reserved field corresponds to Sbz2 in the MS-DTYP ACL wire format and must be zero. Uninitialized heap data leaked into ACL traffic sent to SMB servers, causing functional failures and exposing slab contents on the wire.
Critical Impact
Uninitialized kernel heap memory is transmitted in SMB security descriptors. Samba servers reject the malformed ACL with ndr_pull_security_descriptor failed: Range Error, causing chmod operations to fail with EINVAL and potentially leaking small amounts of kernel slab data to remote SMB servers.
Affected Products
- Linux kernel versions containing commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16")
- Linux kernel SMB client (cifs.ko) in affected stable branches
- Distributions shipping kernels built from the affected stable trees
Discovery Timeline
- 2026-05-28 - CVE-2026-46139 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46139
Vulnerability Analysis
The defect is an uninitialized memory use [CWE-908] in the Linux kernel SMB client when constructing an on-the-wire security descriptor. After commit 62e7dd0a39c2d reshaped struct smb_acl so that the legacy __le32 num_aces became __le16 num_aces followed by __le16 reserved, the surrounding code in build_sec_desc() continued to populate fields explicitly without zeroing the buffer. The newly introduced reserved field was never written, so it retained whatever bytes the slab allocator returned.
When the slab garbage happened to be non-zero, the resulting ACL violated the MS-DTYP specification, which requires Sbz2 to be zero. Samba's NDR parser strictly validates this field and rejects the descriptor with a Range Error, surfacing to userspace as chmod returning EINVAL. Beyond the functional break, every such request also leaks two bytes of kernel heap data to the remote SMB server, creating a low-volume information disclosure channel.
Root Cause
The root cause is the use of kmalloc() for an output buffer whose layout includes a field the writer never touches. Switching the allocation to kzalloc() ensures the entire descriptor, including the Sbz2/reserved field, starts at zero before per-field writes occur.
Attack Vector
Exploitation requires no remote attacker action. The condition is triggered by normal chmod or ACL operations on a mounted SMB share. A malicious or curious SMB server can observe the leaked two bytes per request in the security descriptors received from the client. Reachability is local-to-the-client for triggering and remote-observable for the leaked bytes.
No public exploit or proof-of-concept code is associated with this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-46139
Indicators of Compromise
- Repeated chmod failures returning EINVAL against SMB/CIFS-mounted shares from Linux clients.
- Samba server logs containing ndr_pull_security_descriptor failed: Range Error originating from Linux client IPs.
- Kernel versions matching the affected stable trees referenced in the upstream commits 4c3ed34, 5e489c6, 941a1e6, 9bdb2ca, and be1ef95.
Detection Strategies
- Inventory running kernel versions across Linux hosts and compare against the fixed commits listed in the upstream stable advisories.
- Correlate client-side cifs mount activity with server-side Samba parser errors to identify hosts running vulnerable kernels.
- Audit package manifests for kernel builds that do not yet include the kzalloc fix in build_sec_desc().
Monitoring Recommendations
- Forward Samba and SMB server logs to a centralized log platform and alert on ndr_pull_security_descriptor parser errors.
- Monitor SMB client error rates for EINVAL on ACL-modifying syscalls across Linux fleets.
- Track kernel upgrade compliance against the stable trees identified in the kernel.org commits.
How to Mitigate CVE-2026-46139
Immediate Actions Required
- Update affected Linux hosts to a kernel release that includes one of the fix commits: 4c3ed34, 5e489c6, 941a1e6, 9bdb2ca, or be1ef95.
- Reboot hosts after kernel package upgrades so the patched cifs module is loaded.
- Restrict outbound SMB connections from Linux clients to trusted servers to limit who can observe leaked bytes.
Patch Information
The upstream fix changes the allocation in build_sec_desc() from kmalloc() to kzalloc(), ensuring the entire security descriptor buffer, including the Sbz2/reserved field, is zero-initialized before per-field writes. The fix has been backported across multiple stable branches as referenced by the kernel.org commits above. Distribution vendors ship the fix through their standard kernel update channels.
Workarounds
- Avoid performing chmod or ACL changes on CIFS/SMB-mounted shares from affected clients until the kernel is patched.
- Where feasible, mount shares with options that bypass POSIX ACL translation, such as omitting cifsacl and using server-side permission management.
- Limit Linux SMB client traffic to internal, trusted Samba servers to reduce exposure of the two-byte heap leak.
# Verify kernel version and confirm the fix is present
uname -r
# On Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/-.*//')
# On RHEL/Rocky/AlmaLinux
sudo dnf update kernel
# Reboot to load the patched cifs module
sudo systemctl reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
