Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a… (CVE-2026-46155)
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
AI Analysis
Technical Summary
This vulnerability involves an out-of-bounds read in the smb2_compound_op() function within Microsoft and Azure Linux 3.0 SMB client implementations. The out-of-bounds read could cause improper memory access, potentially leading to application crashes or information disclosure. No further technical details, CVSS score, or exploit information is provided in the available data. The vendor advisory from Microsoft Security Response Center does not include patch or mitigation information at this time.
Potential Impact
The impact is currently unclear due to lack of detailed information and absence of a CVSS score. Out-of-bounds reads can lead to application instability or information disclosure, but no known exploits or confirmed impact scenarios are reported. Without vendor guidance, the exact risk level remains uncertain.
Mitigation Recommendations
Patch status is not yet confirmed — check the Microsoft Security Response Center advisory for current remediation guidance. No official fix or mitigation instructions are provided in the available data. Users should monitor vendor communications for updates.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a… (CVE-2026-46155)
Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
CVSS v3.1
Score 9.1critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves an out-of-bounds read in the smb2_compound_op() function within Microsoft and Azure Linux 3.0 SMB client implementations. The out-of-bounds read could cause improper memory access, potentially leading to application crashes or information disclosure. No further technical details, CVSS score, or exploit information is provided in the available data. The vendor advisory from Microsoft Security Response Center does not include patch or mitigation information at this time.
Potential Impact
The impact is currently unclear due to lack of detailed information and absence of a CVSS score. Out-of-bounds reads can lead to application instability or information disclosure, but no known exploits or confirmed impact scenarios are reported. Without vendor guidance, the exact risk level remains uncertain.
Mitigation Recommendations
Patch status is not yet confirmed — check the Microsoft Security Response Center advisory for current remediation guidance. No official fix or mitigation instructions are provided in the available data. Users should monitor vendor communications for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_vex
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2026-46155
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a19fed0e29bf47b500fe3bb
Added to database: 05/29/2026, 21:02:08 UTC
Last enriched: 05/29/2026, 21:13:43 UTC
Last updated: 07/31/2026, 21:29:00 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.