CVE-2026-46195

The functions parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() add the server-supplied dacloffset parameter to the pntsd pointer without prior validation that the resulting pointer falls within the bounds of the returned security descriptor. On 32-bit kernel compilations, a malicious server can return a dacloffset close to the U32_MAX value, which causes the computed DACL pointer to wrap below end_of_acl. Subsequent boundary checks based on pointers are then bypassed, and the build_sec_desc() and id_mode_to_cifs_acl() functions can extract DACL fields from an incorrect memory address in the chmod/chown code paths. The fix consists of numerically validating dacloffset before creating any DACL pointer, using a shared helper function at all three DACL entry points.

An attacker controlling the SMB server response can cause arbitrary kernel memory read or overwrite, which consequently may result in privilege escalation, sensitive data disclosure, or system destabilization.

Apply patches available from the vendor according to the references — fixes have been published in the stable branches repository of the Linux kernel (git.kernel.org/stable); recommended update to a kernel version containing the appropriate commits

Linux kernel — SMB client (CIFS), 32-bit compilations; specific versions indicated in vendor references (commits in stable kernel branches)