NetSight
IP …
critical9.1

CVE-2026-46155

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated resp…

Impact

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 6.6.32 before 6.6.140
from 6.9 before 6.12.88
from 6.13 before 6.18.30
from 6.19 before 7.0.7
Version 7.1

Weakness classification

CWE-125

References