CVE-2026-46155 — smb/client: fix out-of-bounds read in smb2_compound_op()

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix out-of-bounds read in smb2_compound_op()

If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len.

Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]);

Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.

RHSA-2026:36018 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete kernel: smb/client: fix out-of-bounds read in smb2_compound_op() kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs

Most recent entries from all

CVE-2026-46155 — smb/client: fix out-of-bounds read in smb2_compound_op()

RHSA-2026:36018 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update