CVE-2026-46155
CRITICALCVSS v3.1: 9.1 · EPSS: 0.0006 (19.1 percentile)
Source data as of:
At a glance
- Severity
- CRITICAL
- CVSS
- 9.1 v3.1 · NVD
- EPSS
- 0.0006 (19.1 percentile) · FIRST.org
- CISA KEV
- No
- Type
- Out-of-bounds Read · NVD CWE
- Attack conditions (CVSS vector)
- NetworkNo privilegesNo user interaction · Source: NVD Vector
- Affected vendors
- linux
- Published
- 2026-05-28 · Modified: 2026-06-09
- References
- Jump to references (5)
CVSS / EPSS / KEV
Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources
Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
References
Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.
- Reference https://git.kernel.org/stable/c/512d33bc8ea4ea5c19728ee118715f4b1f4d1926
- Reference https://git.kernel.org/stable/c/8d09328dfda089675e4c049f3f256064a1d1996b
- Reference https://git.kernel.org/stable/c/9b3af35645ff9cd334edc130249f9a2fb2bea25f
- Reference https://git.kernel.org/stable/c/a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c
- Reference https://git.kernel.org/stable/c/dffb44b2e06a2908e249f0f93156fc987eee1d1c