CVE-2026-46195

What it actually does

This flaw affects the Linux kernel SMB/CIFS client code that parses server-supplied Windows security descriptors. A malicious SMB server can return a crafted DACL offset value that is not numerically validated before pointer arithmetic is performed. On vulnerable 32-bit kernel builds, the offset can wrap around the address space, causing subsequent bounds checks to be bypassed and allowing the kernel to dereference attacker-controlled or invalid memory during SMB ACL handling, especially chmod/chown-related rewrite paths. The result is a kernel memory corruption condition with potential confidentiality, integrity, and availability impact, including kernel crash and possible kernel-level code execution depending on architecture, memory layout, and exploitability constraints.

Why it matters to the business

Systems that mount or interact with untrusted SMB shares using a vulnerable 32-bit Linux kernel could be crashed or potentially compromised at the kernel level by a malicious file server. Operationally, this can cause endpoint or appliance outages, loss of availability for file-sharing workflows, and, in a worst case, privileged system compromise. The risk is highest where Linux systems automatically mount SMB shares, connect to user-controlled file servers, or operate in environments where attackers can impersonate or redirect SMB traffic. The vulnerability has a high CVSS score, but currently has low EPSS, no known public exploit maturity, and is not listed in CISA KEV, so remediation should be prioritized based on SMB client exposure and use of 32-bit kernel builds.

How an attack unfolds

An attacker positions or operates a malicious SMB server and induces a vulnerable Linux SMB/CIFS client to connect to it, mount a share, or perform file permission operations that cause the kernel client to request and parse security descriptor data. The malicious server returns a security descriptor containing a DACL offset near the 32-bit unsigned integer limit. Vulnerable client code adds that offset to the descriptor base pointer before proving that a valid DACL header is contained within the returned buffer. On 32-bit builds, the arithmetic can wrap, producing a pointer that appears to satisfy later pointer-based bounds checks. When chmod or chown-related SMB ACL rewrite paths process the descriptor, the kernel may read or use DACL fields through the wrapped pointer. Successful exploitation can trigger a kernel fault, denial of service, or potentially permit more serious memory corruption effects. There are no named threat actors or known ransomware campaigns associated with this issue in the provided intelligence.

How to fix it

Apply the Linux kernel update from the relevant distribution or vendor that includes the SMB client fix validating dacloffset before DACL pointer construction. No exact fixed kernel versions were provided in the input, so use vendor advisories for the affected distribution, appliance, container host, embedded system, or long-term support kernel branch. Prioritize patching 32-bit Linux systems and any systems that mount SMB/CIFS shares from untrusted, user-controlled, partner, or internet-adjacent networks. If immediate patching is not possible, reduce exposure by disabling unnecessary CIFS/SMB client use, preventing mounts from untrusted SMB servers, restricting outbound TCP/445 and TCP/139 where not required, disabling automount behavior for SMB shares, and ensuring SMB traffic cannot be redirected through DNS, LLMNR, NetBIOS, or proxy mechanisms to attacker-controlled servers.

How to confirm the fix worked

Confirm remediation by verifying the running kernel package includes the vendor fix for the SMB client DACL offset validation issue, not merely that an updated package is installed but pending reboot. Validate with uname, package manager state, and distribution security advisory references. Inventory systems for 32-bit kernels and loaded CIFS/SMB client support, such as the cifs kernel module or active CIFS mounts. Confirm that untrusted SMB egress is blocked or monitored where business processes do not require it. Where safe test procedures exist from a trusted vendor or lab, reproduce the vulnerable parsing behavior only in an isolated environment and confirm the patched kernel rejects malformed security descriptors without kernel faults.

Typical attack path

1. Attacker controls, compromises, or spoofs an SMB server reachable by a vulnerable Linux system.
2. Attacker convinces or causes the Linux SMB/CIFS client to connect to the malicious SMB share, such as through manual mounting, automated mounts, scripts, desktop file access, or network redirection.
3. The client performs an operation that causes SMB security descriptor and ACL handling, particularly permission-related chmod or chown paths.
4. The malicious SMB server returns a crafted security descriptor with a DACL offset designed to trigger 32-bit arithmetic wraparound.
5. The vulnerable kernel SMB client builds a DACL pointer before numerically validating that the DACL header fits inside the returned descriptor.
6. The wrapped pointer bypasses later pointer-based bounds checks.
7. The kernel dereferences invalid or attacker-influenced memory, causing a crash or potential kernel-level memory corruption.

How to detect it

To determine whether exploitation may already have occurred, review host kernel logs, system journals, crash dumps, and network telemetry around SMB/CIFS client activity. Focus on systems that are 32-bit, have active CIFS mounts, recently connected to unfamiliar SMB servers, or experienced unexplained kernel crashes after file permission changes on mounted SMB shares. Useful log sources include journalctl, /var/log/kern.log, /var/log/messages, /var/log/syslog, kernel crash dump directories, EDR process/network telemetry, firewall logs, DNS logs, and NetFlow records for outbound SMB connections. Look for CIFS VFS errors followed closely by kernel Oops, general protection faults, page faults, panics, or reboots. Investigate outbound connections to unexpected TCP/445 or TCP/139 destinations, especially if followed by chmod/chown activity, mount.cifs execution, kernel module loading, or system instability. There are no public exploit-specific payload signatures provided, so detection should combine SMB destination anomalies, kernel fault artifacts, and timing correlation.

• CIFS VFS:
• mount.cifs
• modprobe cifs
• kernel: CIFS
• BUG: unable to handle kernel paging request
• Oops:
• general protection fault
• Kernel panic - not syncing
• Unable to handle kernel NULL pointer dereference
• TCP/445
• TCP/139
• /proc/fs/cifs/DebugData
• /sys/module/cifs
• /var/crash/
• /var/lib/systemd/coredump/
• chown
• chmod

What your security team should do

• Patch vulnerable Linux kernel builds using the distribution or vendor kernel update that contains the SMB client dacloffset validation fix.
• Prioritize 32-bit Linux systems, embedded appliances, legacy hosts, and systems that mount SMB/CIFS shares from outside tightly controlled server allowlists.
• Inventory active CIFS mounts and systems with the cifs module loaded to identify where the vulnerable code path may be reachable.
• Restrict outbound SMB traffic to approved file servers only; block or alert on SMB connections to unknown destinations.
• Disable SMB automounting or user-initiated mounting from untrusted networks where feasible.
• Monitor kernel logs for CIFS-related faults, Oops messages, panics, or crashes following SMB connections or permission-change operations.
• Review DNS, LLMNR, NetBIOS, and WPAD-style redirection risks that could cause clients to connect to attacker-controlled SMB servers.
• Because this issue is not currently in CISA KEV and has low EPSS, schedule broad remediation according to normal kernel patch SLAs, but accelerate for exposed SMB-client-heavy or legacy 32-bit environments.