GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46185 (GCVE-0-2026-46185)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:36 – Updated: 2026-08-05 12:30
VLAI
Title
smb/client: fix out-of-bounds read in symlink_data()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer only contains the base SMB2 header (64 bytes), accessing err->ErrorContextCount (at offset 66) or err->ByteCount later in symlink_data() will cause an out-of-bounds read.
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < 2be11faf79e49fb8250a181ff0b4d2b2f084af83 (git)
Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < ef6495d4df6e7af8f3de67e65150881c880f696c (git)
Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < 15dc0a4de743a1aaa7b859b3aea79f08c695396c (git)
Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < b8c8a704f0bc133deb171f6aeb6f3a684203e212 (git)
Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < b9561402489d41149f63e001a74384863b7b30a6 (git)
Affected: 76894f3e2f71177747b8b4763fb180e800279585 , < d62b8d236fab503c6fec1d3e9a38bea71feaca20 (git)
Affected: 2d046892a493d9760c35fdaefc3017f27f91b621 (git)
Affected: 6.0.16 , < 6.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2be11faf79e49fb8250a181ff0b4d2b2f084af83",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "ef6495d4df6e7af8f3de67e65150881c880f696c",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "15dc0a4de743a1aaa7b859b3aea79f08c695396c",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "b8c8a704f0bc133deb171f6aeb6f3a684203e212",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "b9561402489d41149f63e001a74384863b7b30a6",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "d62b8d236fab503c6fec1d3e9a38bea71feaca20",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2d046892a493d9760c35fdaefc3017f27f91b621",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix out-of-bounds read in symlink_data()\n\nSince smb2_check_message() returns success without length validation for\nthe symlink error response, in symlink_data() it is possible for\niov-\u003eiov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer\nonly contains the base SMB2 header (64 bytes), accessing\nerr-\u003eErrorContextCount (at offset 66) or err-\u003eByteCount later in\nsymlink_data() will cause an out-of-bounds read."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is in the SMB *client*, triggered by a crafted symlink error response from a remote (malicious, compromised, or MITM) SMB server over TCP/445; it processes attacker-controlled data from a remote network peer.\nAC:L - A malicious server can deterministically return a CREATE response with STATUS_STOPPED_ON_SYMLINK and len \u003c calc_len (e.g., only the 64-byte base header), reliably reaching symlink_data() with no race or attacker-uncontrolled condition.\nPR:N - The attacker is the remote SMB server; it requires no credentials or privileges on the victim client to send the malformed response, which is parsed during normal open/error handling.\nUI:N - Once a share is mounted (e.g., persistent fstab/autofs mount to a compromised or MITM\u0027d server), routine file access makes the server return the crafted symlink error with no additional victim action required per exploit.\nS:U - The out-of-bounds read stays within the client kernel\u0027s own memory and security authority; no privilege or sandbox boundary is crossed.\nC:H - An out-of-bounds read of adjacent kernel heap memory; in this same symlink-parse path (cf. CVE-2026-31613) OOB bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2).\nI:N - The flaw is purely an out-of-bounds read of the error response buffer; it does not modify kernel memory.\nA:H - Reading past the message bounds can dereference invalid/unmapped memory and oops the client kernel, causing a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:18.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2be11faf79e49fb8250a181ff0b4d2b2f084af83"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef6495d4df6e7af8f3de67e65150881c880f696c"
        },
        {
          "url": "https://git.kernel.org/stable/c/15dc0a4de743a1aaa7b859b3aea79f08c695396c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8c8a704f0bc133deb171f6aeb6f3a684203e212"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9561402489d41149f63e001a74384863b7b30a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d62b8d236fab503c6fec1d3e9a38bea71feaca20"
        }
      ],
      "title": "smb/client: fix out-of-bounds read in symlink_data()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46185",
    "datePublished": "2026-05-28T09:36:39.318Z",
    "dateReserved": "2026-05-13T15:03:33.103Z",
    "dateUpdated": "2026-08-05T12:30:18.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46185",
      "date": "2026-09-15",
      "epss": "0.00513",
      "percentile": "0.42253"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:47:36.000Z",
      "cve": "CVE-2026-46185",
      "id": "msrc_CVE-2026-46185",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb/client: fix out-of-bounds read in symlink_data()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46185.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46185\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:34.117\",\"lastModified\":\"2026-06-17T10:53:14.233\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb/client: fix out-of-bounds read in symlink_data()\\n\\nSince smb2_check_message() returns success without length validation for\\nthe symlink error response, in symlink_data() it is possible for\\niov-\u003eiov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer\\nonly contains the base SMB2 header (64 bytes), accessing\\nerr-\u003eErrorContextCount (at offset 66) or err-\u003eByteCount later in\\nsymlink_data() will cause an out-of-bounds read.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb2misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"76894f3e2f71177747b8b4763fb180e800279585\",\"lessThan\":\"2be11faf79e49fb8250a181ff0b4d2b2f084af83\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76894f3e2f71177747b8b4763fb180e800279585\",\"lessThan\":\"ef6495d4df6e7af8f3de67e65150881c880f696c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76894f3e2f71177747b8b4763fb180e800279585\",\"lessThan\":\"15dc0a4de743a1aaa7b859b3aea79f08c695396c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76894f3e2f71177747b8b4763fb180e800279585\",\"lessThan\":\"b8c8a704f0bc133deb171f6aeb6f3a684203e212\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76894f3e2f71177747b8b4763fb180e800279585\",\"lessThan\":\"b9561402489d41149f63e001a74384863b7b30a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76894f3e2f71177747b8b4763fb180e800279585\",\"lessThan\":\"d62b8d236fab503c6fec1d3e9a38bea71feaca20\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d046892a493d9760c35fdaefc3017f27f91b621\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.0.16\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/smb2misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.88\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"F6B59BC3-B31E-4974-B7FC-12ECC3E05E29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"A1A92866-F406-43B5-B2D1-CFC274753E9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.88\",\"matchCriteriaId\":\"5AFBE0EC-CCDF-4207-AE92-ABF958125CA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15dc0a4de743a1aaa7b859b3aea79f08c695396c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2be11faf79e49fb8250a181ff0b4d2b2f084af83\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b8c8a704f0bc133deb171f6aeb6f3a684203e212\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b9561402489d41149f63e001a74384863b7b30a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d62b8d236fab503c6fec1d3e9a38bea71feaca20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef6495d4df6e7af8f3de67e65150881c880f696c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-04T08:02:58+00:00",
      "cve": "CVE-2026-46185",
      "id": "CVE-2026-46185",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb/client: fix out-of-bounds read in symlink_data()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46185.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:11:28Z",
      "cve": "CVE-2026-46185",
      "id": "CVE-2026-46185",
      "initial_release_date": "2026-05-29T01:15:34Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "528",
      "product_status:known_not_affected": "175",
      "product_status:recommended": "364",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46185",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46185.json",
      "version": "17"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…