Description
In the Linux kernel, the following vulnerability has been resolved:

smb: client: use kzalloc to zero-initialize security descriptor buffer

Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces
to le16") split struct smb_acl's __le32 num_aces field into __le16
num_aces and __le16 reserved. The reserved field corresponds to Sbz2
in the MS-DTYP ACL wire format, which must be zero [1].

When building an ACL descriptor in build_sec_desc(), we are using a
kmalloc()'ed descriptor buffer and writing the fields explicitly using
le16() writes now. This never writes to the 2 byte reserved field,
leaving it as uninitialized heap data.

When the reserved field happens to contain non-zero slab garbage,
Samba rejects the security descriptor with "ndr_pull_security_descriptor
failed: Range Error", causing chmod to fail with EINVAL.

Change kmalloc() to kzalloc() to ensure the entire buffer is
zero-initialized.


[1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428
Published: 2026-05-28
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel SMB client incorrectly allocated the security descriptor buffer with kmalloc, leaving a 2‑byte reserved field uninitialized. When that field contained slab garbage, Samba rejected the descriptor and the subsequent chmod operation failed with EINVAL, disrupting the ability to modify file permissions. This flaw does not provide privilege escalation or data exposure but can be used to cause repeated service failures when ACL changes are attempted.

Affected Systems

All Linux kernel releases that include the SMB client before the commit 62e7dd0a39c2 (which changes the allocation to kzalloc) are affected. The issue applies to any system running the kernel with SMB client support and connected to a Samba server that performs ACL changes.

Risk and Exploitability

The vulnerability is local to the SMB client stack and requires the attacker to trigger ACL changes via SMB. With EPSS not available and no listing in KEV, the likelihood of exploitation appears low. The impact is limited to denial of service on permission modifications rather than data loss or privilege escalation.

Generated by OpenCVE AI on May 28, 2026 at 11:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version containing commit 62e7dd0a39c2 which fixes the allocation bug
  • If an immediate kernel upgrade is not possible, restrict use of smbclient or other SMB utilities to trusted users and monitor for chmod failures
  • Apply the source patch directly to the kernel source and rebuild the kernel as a temporary mitigation

Generated by OpenCVE AI on May 28, 2026 at 11:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 28 May 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-788

Thu, 28 May 2026 10:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16") split struct smb_acl's __le32 num_aces field into __le16 num_aces and __le16 reserved. The reserved field corresponds to Sbz2 in the MS-DTYP ACL wire format, which must be zero [1]. When building an ACL descriptor in build_sec_desc(), we are using a kmalloc()'ed descriptor buffer and writing the fields explicitly using le16() writes now. This never writes to the 2 byte reserved field, leaving it as uninitialized heap data. When the reserved field happens to contain non-zero slab garbage, Samba rejects the security descriptor with "ndr_pull_security_descriptor failed: Range Error", causing chmod to fail with EINVAL. Change kmalloc() to kzalloc() to ensure the entire buffer is zero-initialized. [1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428
Title smb: client: use kzalloc to zero-initialize security descriptor buffer
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-28T09:35:55.234Z

Reserved: 2026-05-13T15:03:33.100Z

Link: CVE-2026-46139

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-28T10:16:29.470

Modified: 2026-05-28T13:44:01.663

Link: CVE-2026-46139

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-28T12:00:14Z

Weaknesses