CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data()
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix out-of-bounds read in symlinkdata()
Since smb2checkmessage() returns success without length validation for the symlink error response, in symlinkdata() it is possible for iov->iovlen to be smaller than sizeof(struct smb2errrsp). If the buffer only contains the base SMB2 header (64 bytes), accessing err->ErrorContextCount (at offset 66) or err->ByteCount later in symlinkdata() will cause an out-of-bounds read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46185?
CVE-2026-46185 has a critical severity rating of 9.1.
How do I fix CVE-2026-46185?
To fix CVE-2026-46185, ensure that you update your Linux kernel to the latest version where the vulnerability is addressed.
What type of vulnerability is CVE-2026-46185?
CVE-2026-46185 is an out-of-bounds read vulnerability found in the smb/client in the Linux kernel.
What impact does CVE-2026-46185 have on the Linux kernel?
CVE-2026-46185 can potentially allow attackers to read memory regions outside the intended buffer, leading to data leakage.
Which versions of the Linux kernel are affected by CVE-2026-46185?
CVE-2026-46185 affects specific versions of the Linux kernel prior to the patch that addresses this out-of-bounds read issue.