CVE-2026-46195

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SMB client where the server-supplied dacloffset is added to pntsd before verifying if a DACL header fits within the returned security descriptor. On 32-bit builds, a malicious server can provide a dacloffset value near U32 MAX, causing the derived DACL pointer to wrap around below end of acl and bypass pointer-based bounds checks. This allows the build sec desc() and id mode to cifs acl() functions to dereference DACL fields from the wrapped pointer during chmod or chown rewrite paths. The affected functions include parse sec desc(), build sec desc(), and the chown path in id mode to cifs acl().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.