{"id":"CVE-2026-46195","revision":"b59cfdd464644c038467c42a55e86a69","records":[{"revision":"b59cfdd464644c038467c42a55e86a69","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-46195","aliases":[],"title":"smb: client: validate dacloffset before building DACL pointers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate dacloffset before building DACL pointers\n\nparse_sec_desc(), build_sec_desc(), and the chown path in\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\nbefore proving a DACL header fits inside the returned security\ndescriptor.\n\nOn 32-bit builds a malicious server can return dacloffset near\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\npast the later pointer-based bounds checks. build_sec_desc() and\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\npointer in the chmod/chown rewrite paths.\n\nValidate dacloffset numerically before building any DACL pointer and\nreuse the same helper at the three DACL entry points.","state":0,"publishedAt":"2026-05-28T09:36:48.259+00:00","modifiedAt":"2026-10-19T19:36:54.445+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/cifsacl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\",\n                            \"lessThan\": \"5de2665e913a10ad70aaeecf736b97276e83d995\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\",\n                            \"lessThan\": \"f9dc3be8f403c1216df73e57221f44b045e7ee0b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\",\n                            \"lessThan\": \"ba7f71b6161c0943dafc367565e5843d16b7d505\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\",\n                            \"lessThan\": \"3b1ddba19e77ee35241cd27f16dc3e8d14e08db7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\",\n                            \"lessThan\": \"c688f3ed73d31943334ad2139cb02ec49664322a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\",\n                            \"lessThan\": \"8bd07e417b6bda67e317920584e48cb6ee442a8a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\",\n                            \"lessThan\": \"f98b48151cc502ada59d9778f0112d21f2586ca3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/cifsacl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.176\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.140\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.88\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.30\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.7\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/5de2665e913a10ad70aaeecf736b97276e83d995","https://git.kernel.org/stable/c/f9dc3be8f403c1216df73e57221f44b045e7ee0b","https://git.kernel.org/stable/c/ba7f71b6161c0943dafc367565e5843d16b7d505","https://git.kernel.org/stable/c/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7","https://git.kernel.org/stable/c/c688f3ed73d31943334ad2139cb02ec49664322a","https://git.kernel.org/stable/c/8bd07e417b6bda67e317920584e48cb6ee442a8a","https://git.kernel.org/stable/c/f98b48151cc502ada59d9778f0112d21f2586ca3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46195","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-46195","identifiers":["CVE-2026-46195"]},"retained":false,"historicalAffected":[]}],"coverage":[]}