In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix out-of-bounds read in smb2_compound_op()

If a server sends a truncated response but a large OutputBufferLength, and
terminates the EA list early, check_wsl_eas() returns success without
validating that the entire OutputBufferLength fits within iov_len.

Then smb2_compound_op() does:
memcpy(idata->wsl.eas, data[0], size[0]);

Where size[0] is OutputBufferLength. If iov_len is smaller than size[0],
memcpy can read beyond the end of the rsp_iov allocation and leak adjacent
kernel heap memory.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
7449d736bbbd160c76b01b8fcdf72f58a8757d4b affected < dffb44b2e06a2908e249f0f93156fc987eee1d1c
ea41367b2a602f602ea6594fc4a310520dcc64f4 affected < 9b3af35645ff9cd334edc130249f9a2fb2bea25f
ea41367b2a602f602ea6594fc4a310520dcc64f4 affected < 512d33bc8ea4ea5c19728ee118715f4b1f4d1926
ea41367b2a602f602ea6594fc4a310520dcc64f4 affected < a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c
ea41367b2a602f602ea6594fc4a310520dcc64f4 affected < 8d09328dfda089675e4c049f3f256064a1d1996b
6.6.32 affected < 6.6.140
Linux Linux affected
Version Status Constraints
6.9 affected —
0 unaffected < 6.9
6.6.140 unaffected ≤ 6.6.*
6.12.88 unaffected ≤ 6.12.*
6.18.30 unaffected ≤ 6.18.*
7.0.7 unaffected ≤ 7.0.*
7.1-rc3 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/512d33bc8ea4ea5c19728ee118715f4b1f4d1926 cve-icon cve-icon
https://git.kernel.org/stable/c/8d09328dfda089675e4c049f3f256064a1d1996b cve-icon cve-icon
https://git.kernel.org/stable/c/9b3af35645ff9cd334edc130249f9a2fb2bea25f cve-icon cve-icon
https://git.kernel.org/stable/c/a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c cve-icon cve-icon
https://git.kernel.org/stable/c/dffb44b2e06a2908e249f0f93156fc987eee1d1c cve-icon cve-icon
History

Thu, 28 May 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-20

Thu, 28 May 2026 10:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
Title smb/client: fix out-of-bounds read in smb2_compound_op()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-28T09:36:11.092Z

Reserved: 2026-05-13T15:03:33.102Z

Link: CVE-2026-46155

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-28T10:16:31.133

Modified: 2026-05-28T10:16:31.133

Link: CVE-2026-46155

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-28T12:30:16Z

Weaknesses