CVE-2026-46155 Overview
CVE-2026-46155 is an out-of-bounds read vulnerability in the Linux kernel SMB client. The flaw resides in the smb2_compound_op() function and is triggered when a malicious or malformed SMB server returns a truncated response with an oversized OutputBufferLength. The check_wsl_eas() validation routine returns success without confirming that the declared buffer length fits within the actual iov_len, allowing a subsequent memcpy() to read past the end of the rsp_iov allocation. The result is disclosure of adjacent kernel heap memory to userspace consumers of the SMB client.
Critical Impact
A remote SMB server can leak adjacent Linux kernel heap memory to the client by sending a crafted response with an early-terminated extended attribute (EA) list and an inflated OutputBufferLength.
Affected Products
- Linux kernel SMB client (fs/smb/client)
- Distributions shipping vulnerable kernel versions prior to the fix commits
- Systems mounting remote SMB shares using the in-kernel client
Discovery Timeline
- 2026-05-28 - CVE-2026-46155 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46155
Vulnerability Analysis
The vulnerability is an out-of-bounds read in the Linux kernel SMB client code path that handles compounded SMB2 operations carrying Windows Subsystem for Linux (WSL) extended attributes. When the client receives a server response, check_wsl_eas() walks the embedded EA list to confirm structural validity. The function returns success as soon as it encounters a terminating entry, even if the server-declared OutputBufferLength extends beyond the bytes actually delivered in the I/O vector. smb2_compound_op() then trusts that length and issues memcpy(idata->wsl.eas, data[0], size[0]), where size[0] equals OutputBufferLength. If iov_len is smaller than size[0], the copy reads past the end of the response buffer and into adjacent kernel slab memory.
Root Cause
The root cause is missing length validation. check_wsl_eas() validates the contents of the EA list but does not enforce that the full OutputBufferLength lies within the bounds of the underlying iov_len. Trust in attacker-controlled length fields propagates directly into a copy operation, which is the classic pattern behind out-of-bounds read [CWE-125] flaws in protocol parsers.
Attack Vector
Exploitation requires the Linux host to act as an SMB client against an attacker-controlled or compromised SMB server. The server returns a crafted SMB2 response containing a truncated payload, an early EA terminator, and an inflated OutputBufferLength. When the client copies the response into the WSL EA structure, it reads kernel heap memory past the response allocation. The leaked bytes can then be exposed to the requesting userspace process, enabling reconnaissance against kernel address space layout randomization (KASLR) and other in-memory secrets adjacent to the SMB response buffer.
No verified public proof-of-concept code is available. See the kernel fix commits referenced below for the precise patched logic.
Detection Methods for CVE-2026-46155
Indicators of Compromise
- Linux clients mounting SMB shares from untrusted or unexpected remote endpoints.
- Kernel warnings, KASAN slab-out-of-bounds reports, or unexplained crashes in smb2_compound_op or check_wsl_eas stack frames.
- SMB2 responses where OutputBufferLength is larger than the on-wire payload size.
Detection Strategies
- Enable KASAN and UBSAN on test kernels to surface out-of-bounds reads in the SMB client during fuzzing.
- Inspect kernel logs (dmesg, journalctl -k) for SMB client warnings tied to EA parsing.
- Audit endpoint and network telemetry for outbound SMB sessions to non-corporate IP ranges that could host malicious servers.
Monitoring Recommendations
- Track running kernel versions across the Linux fleet and flag hosts that have not received vendor backports of commits 512d33bc, 8d09328d, 9b3af356, a16f70a7, or dffb44b2.
- Monitor SMB client connection metadata, including server addresses, mount points, and authentication failures, in a centralized log platform.
- Alert on new or anomalous SMB mounts originating from workstations and servers that do not normally consume remote SMB shares.
How to Mitigate CVE-2026-46155
Immediate Actions Required
- Apply the upstream Linux kernel patches that add bounds checks against iov_len before the memcpy() in smb2_compound_op().
- Restrict outbound SMB (TCP/445) traffic at the network boundary so that Linux clients can only reach trusted file servers.
- Unmount and avoid connecting to untrusted SMB servers until kernels are patched.
Patch Information
The issue is resolved in the mainline and stable Linux kernel trees. Refer to the upstream fix commits: Kernel Git Commit 512d33b, Kernel Git Commit 8d09328d, Kernel Git Commit 9b3af356, Kernel Git Commit a16f70a7, and Kernel Git Commit dffb44b2. Install vendor-supplied kernel updates that include these commits and reboot affected hosts.
Workarounds
- Disable or unload the cifs kernel module on systems that do not require SMB client functionality.
- Block outbound TCP/445 and TCP/139 at host or perimeter firewalls where SMB client usage is not required.
- Limit SMB mounts to known, authenticated file servers and avoid mounting shares from untrusted networks.
# Configuration example: prevent loading of the SMB client module on hosts that do not need it
echo 'install cifs /bin/true' | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo rmmod cifs 2>/dev/null || true
# Verify the running kernel version against patched releases
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
