CVE-2026-46195

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46195", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.104Z", "datePublished": "2026-05-28T09:36:48.259Z", "dateUpdated": "2026-10-19T19:36:54.445Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:30:20.801Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate dacloffset before building DACL pointers\n\nparse_sec_desc(), build_sec_desc(), and the chown path in\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\nbefore proving a DACL header fits inside the returned security\ndescriptor.\n\nOn 32-bit builds a malicious server can return dacloffset near\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\npast the later pointer-based bounds checks. build_sec_desc() and\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\npointer in the chmod/chown rewrite paths.\n\nValidate dacloffset numerically before building any DACL pointer and\nreuse the same helper at the three DACL entry points."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The malicious data is the SMB server's security-descriptor response processed by the in-kernel CIFS client over TCP/445; a remote server (or MITM) supplies the crafted dacloffset, so the vulnerable code is reached purely via network protocol data.\nAC:L - On a 32-bit target the attacker fully controls dacloffset and thus the wrapped pointer target, reliably bypassing the bounds checks and reliably forcing a dereference (e.g. unmapped memory for a guaranteed crash); no condition outside attacker control is needed once the target is the affected architecture.\nPR:N - The attacker is the SMB server itself (or a MITM) and needs no account or privilege on the victim client; the client parses the malicious response automatically.\nUI:N - Under the reasonable compromised-server/MITM model the parse path fires during routine file access (stat/ls) on an already-mounted share, requiring no victim action at attack time.\nS:U - The corruption stays within the kernel's own memory and security authority; no crossing into another security scope (VM/IOMMU) occurs.\nC:H - The attacker-controlled wrapped pointer is an arbitrary-address read primitive; the read kernel memory influences file mode bits (observable) and is copied into the ACL returned to the server, providing a genuine disclosure channel.\nI:H - This is server-controlled memory corruption: OOB-read DACL/ACE data with attacker-influenced sizes/counts is copied into a fixed-size heap buffer in the chmod path, giving a plausible OOB-write primitive, consistent with treating memory corruption as high integrity impact.\nA:H - Dereferencing the attacker-positioned wrapped pointer (typically unmapped memory) reliably triggers a kernel oops/panic, a full denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsacl.c"], "versions": [{"version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "5de2665e913a10ad70aaeecf736b97276e83d995", "status": "affected", "versionType": "git"}, {"version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "f9dc3be8f403c1216df73e57221f44b045e7ee0b", "status": "affected", "versionType": "git"}, {"version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "ba7f71b6161c0943dafc367565e5843d16b7d505", "status": "affected", "versionType": "git"}, {"version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "3b1ddba19e77ee35241cd27f16dc3e8d14e08db7", "status": "affected", "versionType": "git"}, {"version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "c688f3ed73d31943334ad2139cb02ec49664322a", "status": "affected", "versionType": "git"}, {"version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "8bd07e417b6bda67e317920584e48cb6ee442a8a", "status": "affected", "versionType": "git"}, {"version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "f98b48151cc502ada59d9778f0112d21f2586ca3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/cifsacl.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5de2665e913a10ad70aaeecf736b97276e83d995"}, {"url": "https://git.kernel.org/stable/c/f9dc3be8f403c1216df73e57221f44b045e7ee0b"}, {"url": "https://git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505"}, {"url": "https://git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7"}, {"url": "https://git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a"}, {"url": "https://git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a"}, {"url": "https://git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3"}], "title": "smb: client: validate dacloffset before building DACL pointers", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8::nfv"], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.18.0-553.126.1.rt7.467.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.18.0-553.126.1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9", "cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.14.0-687.12.1.el9_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "datePublic": "2026-05-28T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in the Linux kernel's Server Message Block (SMB) client. A malicious server can exploit this vulnerability on 32-bit systems by providing a crafted dacloffset value. This can cause a pointer wrap, leading to the dereferencing of invalid Discretionary Access Control List (DACL) fields during chmod or chown operations. This memory corruption could potentially allow the malicious server to bypass security mechanisms or cause a denial of service."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-46195"}, {"name": "RHBZ#2482606", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482606"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46195.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:21556"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:21706"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:21745"}], "solutions": [{"lang": "en", "value": "RHSA-2026:21556: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"}, {"lang": "en", "value": "RHSA-2026:21706: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"}, {"lang": "en", "value": "RHSA-2026:21745: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"}], "timeline": [{"lang": "en", "time": "2026-05-28T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-28T00:00:00.000Z", "value": "Made public."}], "title": "kernel: smb: client: validate dacloffset before building DACL pointers", "workarounds": [{"lang": "en", "value": "To mitigate this issue, avoid mounting shares from untrusted SMB servers on 32-bit Red Hat Enterprise Linux systems. If interaction with untrusted SMB servers is unavoidable, consider isolating affected systems or restricting network access to only known, trusted SMB servers."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-11T12:09:11.879Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:21:16.154Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46195", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:20:56.572317Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:36:54.445Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46195", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:20:56.572317Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-16T15:20:57.140Z"}}], "cna": {"title": "smb: client: validate dacloffset before building DACL pointers", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The malicious data is the SMB server's security-descriptor response processed by the in-kernel CIFS client over TCP/445; a remote server (or MITM) supplies the crafted dacloffset, so the vulnerable code is reached purely via network protocol data.\nAC:L - On a 32-bit target the attacker fully controls dacloffset and thus the wrapped pointer target, reliably bypassing the bounds checks and reliably forcing a dereference (e.g. unmapped memory for a guaranteed crash); no condition outside attacker control is needed once the target is the affected architecture.\nPR:N - The attacker is the SMB server itself (or a MITM) and needs no account or privilege on the victim client; the client parses the malicious response automatically.\nUI:N - Under the reasonable compromised-server/MITM model the parse path fires during routine file access (stat/ls) on an already-mounted share, requiring no victim action at attack time.\nS:U - The corruption stays within the kernel's own memory and security authority; no crossing into another security scope (VM/IOMMU) occurs.\nC:H - The attacker-controlled wrapped pointer is an arbitrary-address read primitive; the read kernel memory influences file mode bits (observable) and is copied into the ACL returned to the server, providing a genuine disclosure channel.\nI:H - This is server-controlled memory corruption: OOB-read DACL/ACE data with attacker-influenced sizes/counts is copied into a fixed-size heap buffer in the chmod path, giving a plausible OOB-write primitive, consistent with treating memory corruption as high integrity impact.\nA:H - Dereferencing the attacker-positioned wrapped pointer (typically unmapped memory) reliably triggers a kernel oops/panic, a full denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "5de2665e913a10ad70aaeecf736b97276e83d995", "versionType": "git"}, {"status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "f9dc3be8f403c1216df73e57221f44b045e7ee0b", "versionType": "git"}, {"status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "ba7f71b6161c0943dafc367565e5843d16b7d505", "versionType": "git"}, {"status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "3b1ddba19e77ee35241cd27f16dc3e8d14e08db7", "versionType": "git"}, {"status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "c688f3ed73d31943334ad2139cb02ec49664322a", "versionType": "git"}, {"status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "8bd07e417b6bda67e317920584e48cb6ee442a8a", "versionType": "git"}, {"status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "lessThan": "f98b48151cc502ada59d9778f0112d21f2586ca3", "versionType": "git"}], "programFiles": ["fs/smb/client/cifsacl.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.140", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.88", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.30", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.7", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/cifsacl.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5de2665e913a10ad70aaeecf736b97276e83d995"}, {"url": "https://git.kernel.org/stable/c/f9dc3be8f403c1216df73e57221f44b045e7ee0b"}, {"url": "https://git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505"}, {"url": "https://git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7"}, {"url": "https://git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a"}, {"url": "https://git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a"}, {"url": "https://git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate dacloffset before building DACL pointers\n\nparse_sec_desc(), build_sec_desc(), and the chown path in\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\nbefore proving a DACL header fits inside the returned security\ndescriptor.\n\nOn 32-bit builds a malicious server can return dacloffset near\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\npast the later pointer-based bounds checks. build_sec_desc() and\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\npointer in the chmod/chown rewrite paths.\n\nValidate dacloffset numerically before building any DACL pointer and\nreuse the same helper at the three DACL entry points."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.140", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.88", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.30", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.7", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:30:20.801Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46195", "state": "PUBLISHED", "dateUpdated": "2026-10-15T01:21:16.154Z", "dateReserved": "2026-05-13T15:03:33.104Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-28T09:36:48.259Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/cifsacl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5de2665e913a10ad70aaeecf736b97276e83d995", "status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "versionType": "git"}, {"lessThan": "f9dc3be8f403c1216df73e57221f44b045e7ee0b", "status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "versionType": "git"}, {"lessThan": "ba7f71b6161c0943dafc367565e5843d16b7d505", "status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "versionType": "git"}, {"lessThan": "3b1ddba19e77ee35241cd27f16dc3e8d14e08db7", "status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "versionType": "git"}, {"lessThan": "c688f3ed73d31943334ad2139cb02ec49664322a", "status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "versionType": "git"}, {"lessThan": "8bd07e417b6bda67e317920584e48cb6ee442a8a", "status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "versionType": "git"}, {"lessThan": "f98b48151cc502ada59d9778f0112d21f2586ca3", "status": "affected", "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/cifsacl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.88", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8::nfv"], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.18.0-553.126.1.rt7.467.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.18.0-553.126.1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9", "cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.14.0-687.12.1.el9_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "806BFCDD-40F7-4D92-8A27-BFFEF6F38F7B", "versionEndExcluding": "6.6.140", "versionStartIncluding": "5.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4", "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate dacloffset before building DACL pointers\n\nparse_sec_desc(), build_sec_desc(), and the chown path in\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\nbefore proving a DACL header fits inside the returned security\ndescriptor.\n\nOn 32-bit builds a malicious server can return dacloffset near\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\npast the later pointer-based bounds checks. build_sec_desc() and\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\npointer in the chmod/chown rewrite paths.\n\nValidate dacloffset numerically before building any DACL pointer and\nreuse the same helper at the three DACL entry points."}], "id": "CVE-2026-46195", "lastModified": "2026-10-19T20:18:37.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46195", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:20:56.572317Z", "version": "2.0.3"}}]}, "published": "2026-05-28T10:16:35.147", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5de2665e913a10ad70aaeecf736b97276e83d995"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f9dc3be8f403c1216df73e57221f44b045e7ee0b"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:21556"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:21706"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:21745"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-46195"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482606"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46195.json"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: smb: client: validate dacloffset before building DACL pointers", "id": "2482606", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482606"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's Server Message Block (SMB) client. A malicious server can exploit this vulnerability on 32-bit systems by providing a crafted dacloffset value. This can cause a pointer wrap, leading to the dereferencing of invalid Discretionary Access Control List (DACL) fields during chmod or chown operations. This memory corruption could potentially allow the malicious server to bypass security mechanisms or cause a denial of service."], "name": "CVE-2026-46195", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46195\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46195\nhttps://lore.kernel.org/linux-cve-announce/2026052833-CVE-2026-46195-f7ef@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc3e9dd9d104ca1b75644eab87b38ce8a924aef4,ba7f71b6161c0943dafc367565e5843d16b7d505)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc3e9dd9d104ca1b75644eab87b38ce8a924aef4,3b1ddba19e77ee35241cd27f16dc3e8d14e08db7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc3e9dd9d104ca1b75644eab87b38ce8a924aef4,c688f3ed73d31943334ad2139cb02ec49664322a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc3e9dd9d104ca1b75644eab87b38ce8a924aef4,8bd07e417b6bda67e317920584e48cb6ee442a8a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc3e9dd9d104ca1b75644eab87b38ce8a924aef4,f98b48151cc502ada59d9778f0112d21f2586ca3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T12:45:06.857958+00:00", "updated": "2026-10-23T01:30:13.890521+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}