PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2026-46139

CVE-2026-46139

kernel: smb: client: use kzalloc to zero-initialize security descriptor buffer

Loading…

Severity

Moderate

Red Hat Product Security

7

CVSS 3.1

Review impact separately from score.

Published · May 28, 2026

Updated · October 29, 2026

Description

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When building an Access Control List (ACL) descriptor, a buffer was not properly zero-initialized, leaving a reserved field with uninitialized heap data. This can lead to Samba rejecting the security descriptor, causing chmod operations to fail with an invalid argument error. This issue can result in a Denial of Service (DoS) for affected file system operations.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-909 · Missing Initialization of Resource