CVE-2026-46195

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A malicious server can exploit this vulnerability on 32-bit systems by providing a crafted dacloffset value. This can cause a pointer wrap, leading to the dereferencing of invalid Discretionary Access Control List (DACL) fields during chmod or chown operations. This memory corruption could potentially allow the malicious server to bypass security mechanisms or cause a denial of service.

This is an Important flaw in the Linux kernel's Server Message Block (SMB) client, affecting 32-bit Red Hat Enterprise Linux systems. A malicious SMB server could exploit a pointer wrap vulnerability during chmod or chown operations, potentially leading to memory corruption, a denial of service, or security mechanism bypass. Exploitation requires the affected 32-bit system to connect to a specially crafted malicious SMB server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid mounting shares from untrusted SMB servers on 32-bit Red Hat Enterprise Linux systems. If interaction with untrusted SMB servers is unavoidable, consider isolating affected systems or restricting network access to only known, trusted SMB servers.