{"id":"CVE-2026-46139","summary":"smb: client: use kzalloc to zero-initialize security descriptor buffer","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: use kzalloc to zero-initialize security descriptor buffer\n\nCommit 62e7dd0a39c2d (\"smb: common: change the data type of num_aces\nto le16\") split struct smb_acl's __le32 num_aces field into __le16\nnum_aces and __le16 reserved. The reserved field corresponds to Sbz2\nin the MS-DTYP ACL wire format, which must be zero [1].\n\nWhen building an ACL descriptor in build_sec_desc(), we are using a\nkmalloc()'ed descriptor buffer and writing the fields explicitly using\nle16() writes now. This never writes to the 2 byte reserved field,\nleaving it as uninitialized heap data.\n\nWhen the reserved field happens to contain non-zero slab garbage,\nSamba rejects the security descriptor with \"ndr_pull_security_descriptor\nfailed: Range Error\", causing chmod to fail with EINVAL.\n\nChange kmalloc() to kzalloc() to ensure the entire buffer is\nzero-initialized.\n\n\n[1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428","modified":"2026-11-13T04:04:19.137584135Z","published":"2026-05-28T09:35:55.234Z","related":["SUSE-SU-2026:24550-1","SUSE-SU-2026:24619-1","SUSE-SU-2026:24643-1","SUSE-SU-2026:24648-1","SUSE-SU-2026:24651-1","SUSE-SU-2026:24662-1","openSUSE-SU-2026:10954-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46139.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/4c3ed344a970aad51388ac3b0145b98318f0e21f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5e489c6c47a2ac15edbaca153b9348e42c1eacab"},{"type":"WEB","url":"https://git.kernel.org/stable/c/941a1e6eb35440336913afc88a82103291956d5d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9bdb2ca31368b7671949dfb94a5d57ffccd01edd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/be1ef9512a3f5a755895c24f31b334342f4aa15b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46139.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46139"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1593ddb37bd124c131fe635397df68e854a03108"},{"fixed":"4c3ed344a970aad51388ac3b0145b98318f0e21f"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"da087905e3270e2291c0afae39a28e7d183e5ec3"},{"fixed":"941a1e6eb35440336913afc88a82103291956d5d"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d"},{"fixed":"be1ef9512a3f5a755895c24f31b334342f4aa15b"},{"fixed":"9bdb2ca31368b7671949dfb94a5d57ffccd01edd"},{"fixed":"5e489c6c47a2ac15edbaca153b9348e42c1eacab"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"191f2f444745087c3c51fd6042a0e25f42315ab0"}]}],"versions":["v6.12.87","v6.12.86","v6.12.85","v6.12.84","v6.12.83","v6.12.82","v6.12.81","v6.12.80","v6.12.79","v6.12.78","v6.12.77","v6.12.76","v6.12.75","v6.12.74","v6.12.73","v6.12.72","v6.12.71","v6.12.70","v6.12.69","v6.12.68","v6.12.67","v6.12.66","v6.12.65","v6.12.64","v6.12.63","v6.12.62","v6.12.61","v6.12.60","v6.12.59","v6.12.58","v6.12.57","v6.12.56","v6.12.55","v6.12.54","v6.12.53","v6.12.52","v6.12.51","v6.12.50","v6.12.49","v6.12.48","v6.12.47","v6.12.46","v6.12.45","v6.12.44","v6.12.43","v6.12.42","v6.12.41","v6.12.40","v6.12.39","v6.12.38","v6.12.37","v6.12.36","v6.12.35","v6.12.34","v6.12.33","v6.12.32","v6.12.31","v6.12.30","v6.12.29","v6.12.28","v6.12.27","v6.12.26","v6.12.25","v6.12.24","v6.12.23","v6.13.12","v6.13.11"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46139.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.23"},{"fixed":"6.12.88"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.11"},{"fixed":"6.14"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.18.30"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46139.json"}}],"schema_version":"1.9.2"}