---
id: CVE-2026-46155
title: 'smb/client: fix out-of-bounds read in smb2_compound_op()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb/client: fix out-of-bounds read in smb2_compound_op()

  If a server sends a truncated response but a large OutputBufferLength, and
  terminates the EA list early, check…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7449d736bbbd160c76b01b8fcdf72f58a8757d4b <
    dffb44b2e06a2908e249f0f93156fc987eee1d1c
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    9b3af35645ff9cd334edc130249f9a2fb2bea25f
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    512d33bc8ea4ea5c19728ee118715f4b1f4d1926
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    8d09328dfda089675e4c049f3f256064a1d1996b
  - Linux >= 6.6.32 < 6.6.140
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:20:35.167464Z'
published: '2026-05-28'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:05.727Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46155'
references:
  - url: 'https://git.kernel.org/stable/c/dffb44b2e06a2908e249f0f93156fc987eee1d1c'
  - url: 'https://git.kernel.org/stable/c/9b3af35645ff9cd334edc130249f9a2fb2bea25f'
  - url: 'https://git.kernel.org/stable/c/512d33bc8ea4ea5c19728ee118715f4b1f4d1926'
  - url: 'https://git.kernel.org/stable/c/a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c'
  - url: 'https://git.kernel.org/stable/c/8d09328dfda089675e4c049f3f256064a1d1996b'
tags:
  - cve.org
epss: 0.00653
epssPercentile: 0.5026
ingestedAt: '2026-10-16T17:24:46.710Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix out-of-bounds read in smb2_compound_op()

If a server sends a truncated response but a large OutputBufferLength, and
terminates the EA list early, check_wsl_eas() returns success without
validating that the entire OutputBufferLength fits within iov_len.

Then smb2_compound_op() does:
    memcpy(idata->wsl.eas, data[0], size[0]);

Where size[0] is OutputBufferLength. If iov_len is smaller than size[0],
memcpy can read beyond the end of the rsp_iov allocation and leak adjacent
kernel heap memory.

## Affected

- `Linux >= 7449d736bbbd160c76b01b8fcdf72f58a8757d4b < dffb44b2e06a2908e249f0f93156fc987eee1d1c`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < 9b3af35645ff9cd334edc130249f9a2fb2bea25f`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < 512d33bc8ea4ea5c19728ee118715f4b1f4d1926`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < a16f70a71be4b5a4eccf39a9bf09b47285f4cb7c`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < 8d09328dfda089675e4c049f3f256064a1d1996b`
- `Linux >= 6.6.32 < 6.6.140`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.