CVE-2026-46155
kernel: smb/client: fix out-of-bounds read in smb2_compound_op()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 28, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2_compound_op() function, allowing the attacker to leak sensitive kernel heap memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-130 · Improper Handling of Length Parameter Inconsistency