CVE-2026-46195: Linux Kernel Privilege Escalation Flaw

CVE-2026-46195 Overview

CVE-2026-46195 is a Linux kernel vulnerability in the SMB client code that affects how the kernel validates server-supplied DACL (Discretionary Access Control List) offsets when parsing security descriptors. The flaw resides in the parse_sec_desc(), build_sec_desc(), and id_mode_to_cifs_acl() functions, which add a server-controlled dacloffset to a pointer before verifying that a DACL header fits inside the returned security descriptor. On 32-bit kernel builds, a malicious SMB server can supply a dacloffset near U32_MAX to induce pointer arithmetic wrap-around. The wrapped pointer evades subsequent bounds checks and can be dereferenced during chmod and chown rewrite paths.

Critical Impact
A malicious SMB server can trigger integer wrap-around in 32-bit Linux kernel builds, bypassing DACL pointer bounds checks and causing out-of-bounds memory access during SMB client ACL operations.

Affected Products

Linux kernel SMB client (fs/smb/client)
32-bit Linux kernel builds with CIFS/SMB client enabled
Systems mounting remote SMB shares from untrusted servers

Discovery Timeline

2026-05-28 - CVE-2026-46195 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46195

Vulnerability Analysis

The vulnerability is an integer overflow leading to a pointer wrap-around in the Linux kernel's SMB client ACL handling code. When the SMB client receives a security descriptor from a remote server, the code at three distinct entry points adds the server-supplied 32-bit dacloffset field to the base pntsd (pointer to NT security descriptor) before validating that the resulting DACL header lies within the returned descriptor buffer.

The three vulnerable call sites are parse_sec_desc(), build_sec_desc(), and the chown path inside id_mode_to_cifs_acl(). Each constructs a DACL pointer through unchecked arithmetic, then performs pointer-based bounds checks against end_of_acl. On 32-bit systems, a dacloffset value close to U32_MAX causes the computed pointer to wrap below the start of the buffer, defeating the pointer comparisons that follow.

Root Cause

The root cause is missing numeric validation of the dacloffset field prior to pointer arithmetic. The original code trusted the server-supplied offset and only performed pointer-range checks after the addition. On 32-bit builds, where uintptr_t is 32 bits wide, adding a large dacloffset to pntsd wraps modulo 2^32, producing a pointer that falsely appears to lie below end_of_acl. This is a classic integer overflow vulnerability [CWE-190] combined with insufficient input validation.

Attack Vector

An attacker must control or impersonate an SMB server that a vulnerable Linux client mounts. When the client requests a security descriptor and then executes chmod or chown against a file on the mounted share, the malicious server returns a crafted descriptor with a dacloffset near U32_MAX. The kernel then dereferences DACL fields from the wrapped pointer, leading to out-of-bounds memory reads or writes in kernel context. Exploitation requires the victim to mount an attacker-controlled share and perform an ACL-modifying operation.

The upstream fix validates dacloffset numerically before any DACL pointer is constructed and centralizes the check in a shared helper invoked from all three entry points. See the Linux Kernel Commit ba7f71b for the patch source.

Detection Methods for CVE-2026-46195

Indicators of Compromise

Kernel oops, panic, or BUG() reports originating from parse_sec_desc(), build_sec_desc(), or id_mode_to_cifs_acl() in dmesg.
Unexpected SMB client crashes or hangs immediately after chmod or chown operations on mounted CIFS/SMB shares.
SMB sessions to untrusted or unexpected remote servers, particularly on 32-bit hosts.

Detection Strategies

Audit kernel logs for fault addresses inside the fs/smb/client ACL code path and correlate with active SMB mounts.
Inspect mount tables for CIFS/SMB shares pointing to servers outside approved infrastructure.
Compare running kernel versions against the fixed commits listed in the upstream stable tree references.

Monitoring Recommendations

Monitor mount and cifs.upcall syscall activity on 32-bit Linux hosts and alert on connections to unknown SMB endpoints.
Forward kernel ring buffer messages to a centralized log platform and create rules for oops signatures referencing CIFS ACL functions.
Track package and kernel update compliance across the Linux fleet, prioritizing 32-bit builds that mount remote SMB shares.

How to Mitigate CVE-2026-46195

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits ba7f71b, 3b1ddba, 8bd07e4, c688f3e, and f98b481 from the stable tree.
Restrict SMB client mounts to trusted servers only, especially on 32-bit kernel builds where the wrap condition is reachable.
Audit all systems running 32-bit Linux kernels that mount CIFS/SMB shares and prioritize them for patching.

Patch Information

The fix validates dacloffset numerically before constructing any DACL pointer and reuses a single helper across parse_sec_desc(), build_sec_desc(), and id_mode_to_cifs_acl(). Patches are available in the upstream stable tree: Linux Kernel Commit 3b1ddba, Linux Kernel Commit 8bd07e4, Linux Kernel Commit ba7f71b, Linux Kernel Commit c688f3e, and Linux Kernel Commit f98b481. Rebuild and redeploy distribution kernels containing these commits.

Workarounds

Unmount SMB shares from untrusted servers until the patched kernel is deployed.
Migrate affected workloads from 32-bit to 64-bit kernel builds, where the pointer wrap condition is not reachable with the same offset values.
Use network segmentation and firewall rules to limit SMB client traffic (TCP/445) to known, trusted file servers only.

bash

# Verify the running kernel and check for vulnerable 32-bit SMB client usage
uname -m
uname -r
grep -E 'cifs|smb' /proc/mounts

# Temporarily unmount untrusted SMB shares until patched
umount -a -t cifs