CVE-2026-46195Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-suppl…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.7%
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate dacloffset before building DACL pointers
parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returned security descriptor.
On 32-bit builds a malicious server can return dacloffset near U32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip past the later pointer-based bounds checks. build_sec_desc() and id_mode_to_cifs_acl() can then dereference DACL fields from the wrapped pointer in the chmod/chown rewrite paths.
Validate dacloffset numerically before building any DACL pointer and reuse the same helper at the three DACL entry points.
Linux >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < 5de2665e913a10ad70aaeecf736b97276e83d995Linux >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < f9dc3be8f403c1216df73e57221f44b045e7ee0bLinux >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < ba7f71b6161c0943dafc367565e5843d16b7d505Linux >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < 3b1ddba19e77ee35241cd27f16dc3e8d14e08db7Linux >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < c688f3ed73d31943334ad2139cb02ec49664322aLinux >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < 8bd07e417b6bda67e317920584e48cb6ee442a8aLinux >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < f98b48151cc502ada59d9778f0112d21f2586ca3Linux 5.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-68286NoneIn the Linux kernel, the following vulnerability has been resolved: drop_monitor: perform u64_stats updates under IRQ-disabled section In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(), u64_stats_update_begin() /…
CVE-2026-68337NoneIn the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpf_net_context The bpf_redirect*() helpers and skb_do_redirect() obtain the per-task bpf_redirect_info via bpf_net_ctx_get_ri()…
CVE-2026-68287High· 7.5In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit attributes net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attri…
CVE-2026-68288NoneIn the Linux kernel, the following vulnerability has been resolved: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to a…
CVE-2026-68289NoneIn the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buf…
CVE-2026-68303NoneIn the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions