CVE-2026-46139
published 2026-05-28CVE-2026-46139: In the Linux kernel, the following vulnerability has been resolved: smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c2d…
high7
In the Linux kernel, the following vulnerability has been resolved:
smb: client: use kzalloc to zero-initialize security descriptor buffer
Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces
to le16") split struct smb_acl's __le32 num_aces field into __le16
num_aces and __le16 reserved. The reserved field corresponds to Sbz2
in the MS-DTYP ACL wire format, which must be zero [1].
When building an ACL descriptor in build_sec_desc(), we are using a
kmalloc()'ed descriptor buffer and writing the fields explicitly using
le16() writes now. This never writes to the 2 byte reserved field,
leaving it as uninitialized heap data.
When the reserved field happens to contain non-zero slab garbage,
Samba rejects the security descriptor with "ndr_pull_security_descriptor
failed: Range Error", causing chmod to fail with EINVAL.
Change kmalloc() to kzalloc() to ensure the entire buffer is
zero-initialized.
[1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 1593ddb37bd124c131fe635397df68e854a03108 < 4c3ed344a970aad51388ac3b0145b98318f0e21f | 4c3ed344a970aad51388ac3b0145b98318f0e21f |
| linux | linux | >= 6.12.23 < 6.12.88 | 6.12.88 |
| linux | linux | >= 6.13.11 < 6.14 | 6.14 |
| linux | linux | >= 62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d < be1ef9512a3f5a755895c24f31b334342f4aa15b | be1ef9512a3f5a755895c24f31b334342f4aa15b |
| linux | linux | >= 62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d < 9bdb2ca31368b7671949dfb94a5d57ffccd01edd | 9bdb2ca31368b7671949dfb94a5d57ffccd01edd |
| linux | linux | >= 62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d < 5e489c6c47a2ac15edbaca153b9348e42c1eacab | 5e489c6c47a2ac15edbaca153b9348e42c1eacab |
| linux | linux | >= da087905e3270e2291c0afae39a28e7d183e5ec3 < 941a1e6eb35440336913afc88a82103291956d5d | 941a1e6eb35440336913afc88a82103291956d5d |
| linux | linux_kernel | — | — |