CVE-2026-46139

What it actually does

This Linux kernel SMB client flaw is caused by an uninitialized two-byte reserved field in an SMB ACL security descriptor buffer. The kernel builds the descriptor with kmalloc() and explicitly writes known ACL fields, but after a structure layout change the reserved field is left containing stale heap contents instead of the required zero value. When the SMB client sends this malformed security descriptor to a Samba or SMB server during permission-changing operations such as chmod, the server may reject it as invalid, causing the operation to fail with EINVAL. The primary impact is local availability disruption for SMB/CIFS permission-management operations rather than remote code execution or privilege escalation.

Why it matters to the business

Systems that rely on Linux SMB/CIFS mounts may experience failed permission changes, broken automation, deployment failures, backup or file-management errors, and helpdesk-visible access control problems. The issue is not listed in CISA KEV, has no known mature exploit, and has a very low EPSS score, so broad active exploitation is unlikely; however, organizations using Linux clients heavily with Samba or SMB-backed storage should still prioritize kernel updates because the failure can disrupt operational workflows that depend on chmod or ACL changes.

How an attack unfolds

An attacker must already have local access to a Linux system and permissions to interact with an SMB/CIFS-mounted filesystem. The attacker performs operations that cause the Linux SMB client to construct and send a security descriptor, such as changing permissions on files or directories. Because the descriptor buffer is not zero-initialized, the reserved ACL field may contain non-zero heap residue. When that malformed descriptor is sent to a Samba or SMB server, the server validates the ACL wire format, detects the non-zero reserved field, and rejects the descriptor. The user-facing result is a failed chmod or ACL operation, typically returning Invalid argument or EINVAL. Exploitation is therefore situational and mainly useful for causing reliability failures in workflows that depend on SMB permission changes.

How to fix it

Upgrade the Linux kernel to a version that includes the SMB client fix changing the security descriptor allocation from kmalloc() to kzalloc(), ensuring the descriptor buffer is zero-initialized. Because no exact fixed package versions were provided, use the kernel versions or vendor advisories from the relevant Linux distribution, appliance vendor, or kernel maintenance branch. Where immediate patching is not possible, reduce exposure by limiting local shell access, restricting who can modify permissions on SMB/CIFS mounts, avoiding workflows that perform chmod or ACL changes on affected SMB mounts, and using patched clients for administrative file-permission operations. Mitigations do not fully correct the kernel bug; a patched kernel is the durable fix.

How to confirm the fix worked

Confirm the running kernel includes the upstream or vendor backport for the SMB client security descriptor zero-initialization fix. Validate package status using the operating system vendor's advisory tooling, such as the distribution security tracker, package changelog, or kernel build metadata. Functionally test by mounting an SMB/CIFS share and repeatedly performing chmod or ACL-changing operations that previously failed; successful completion without EINVAL or Samba security descriptor parsing errors indicates the issue is remediated. Also review server-side Samba logs after testing to confirm that ndr_pull_security_descriptor Range Error messages no longer appear for the patched client.

Typical attack path

1. Obtain local shell or user-level access on a Linux system that mounts an SMB/CIFS share.
2. Identify an SMB-mounted path where the user can attempt permission or ACL changes.
3. Trigger SMB security descriptor generation by running chmod or similar permission-changing operations against files or directories on the mounted share.
4. Rely on the vulnerable kernel SMB client sending an ACL descriptor with a non-zero uninitialized reserved field.
5. Cause the SMB/Samba server to reject the malformed security descriptor.
6. Observe permission-change failures, application errors, or automation breakage caused by EINVAL responses.

How to detect it

This issue leaves limited forensic evidence because exploitation is a local trigger that results in failed SMB permission operations rather than a distinctive remote compromise pattern. Review Samba or SMB server logs for security descriptor parsing failures, especially messages containing ndr_pull_security_descriptor failed and Range Error. Review Linux client logs, application logs, shell history where available, auditd records, and automation job logs for repeated chmod, setfacl, or permission-change failures on CIFS/SMB-mounted paths returning EINVAL or Invalid argument. Correlate timestamps between client-side failed permission operations and server-side malformed security descriptor messages. Look for unusual repetition by a local user account or script, but expect most findings to be operational symptoms rather than confirmed malicious activity. There are no known threat actors, ransomware campaigns, or public exploit artifacts associated with this vulnerability in the provided data.

• ndr_pull_security_descriptor failed: Range Error
• Range Error
• EINVAL
• Invalid argument
• chmod: changing permissions
• cifs
• CIFS
• smb
• SMB
• setfacl

What your security team should do

• Inventory Linux systems that mount SMB/CIFS shares, especially servers running automation, backups, file synchronization, CI/CD, or administrative workflows that modify file permissions.
• Patch affected Linux kernels through the appropriate distribution or vendor channel and prioritize systems with business-critical SMB-mounted storage.
• Monitor Samba and SMB server logs for malformed security descriptor errors and correlate them with Linux client hosts performing chmod or ACL operations.
• If patching must be delayed, restrict local user access and permission-changing operations on SMB-mounted paths to trusted administrators and patched maintenance hosts.
• Document any recurring EINVAL or Invalid argument failures on SMB mounts as potential exposure symptoms, but do not treat them alone as proof of malicious exploitation.
• Because the vulnerability is not in KEV, has no known exploit maturity, and has very low EPSS, prioritize remediation based on SMB usage criticality rather than internet-facing exposure.