CRITICAL
smb DaclOffset Overflow
CVE-2026-46195
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returned security descriptor. On 32-bit builds a malicious server can return dacloffset near U32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip past the later pointer-based bounds checks. build_sec_desc() and id_mode_to_cifs_acl() can then dereference DACL fields from the wrapped pointer in the chmod/chown rewrite paths. Validate dacloffset numerically before building any DACL pointer and reuse the same helper at the three DACL entry points.
02KernelScan AI Analysis
Risk summary
A malicious SMB server can exploit insufficient validation of the DACL offset in the Linux SMB client to cause out-of-bounds memory reads on 32-bit builds. This affects systems mounting SMB shares from untrusted servers and can lead to information disclosure (kernel memory leak) or kernel panic. The vulnerability is specific to 32-bit builds where pointer arithmetic can wrap around, bypassing subsequent bounds checks.
Vulnerability analysis
The root cause is insufficient validation of the server-supplied dacloffset field before using it in pointer arithmetic. On 32-bit systems, a malicious server can provide a dacloffset value near U32_MAX that, when added to the base pointer, wraps around to a lower memory address, bypassing subsequent pointer-based bounds checks. The affected paths (parse_sec_desc(), build_sec_desc(), and id_mode_to_cifs_acl()) then dereference DACL fields from the wrapped pointer, resulting in out-of-bounds reads. These reads can leak kernel slab data (C:Low) and will likely dereference invalid addresses leading to a kernel oops or panic (A:High). There is no direct write primitive to kernel memory (I:None). The fix adds a dacl_offset_valid() helper that validates the offset numerically before any pointer arithmetic, ensuring the resulting DACL pointer stays within the security descriptor bounds.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.88 | 3b1ddba19e77 |
| 6.18 | 6.18.30 | c688f3ed73d3 |
| 6.6 | 6.6.140 | ba7f71b6161c |
| 7.0 | 7.0.7 | 8bd07e417b6b |
| mainline | 7.1-rc3 | f98b48151cc5 |