{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-46139",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-05-13T15:03:33.100Z",
        "datePublished": "2026-05-28T09:35:55.234Z",
        "dateUpdated": "2026-06-14T17:57:22.559Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-06-14T17:57:22.559Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: use kzalloc to zero-initialize security descriptor buffer\n\nCommit 62e7dd0a39c2d (\"smb: common: change the data type of num_aces\nto le16\") split struct smb_acl's __le32 num_aces field into __le16\nnum_aces and __le16 reserved. The reserved field corresponds to Sbz2\nin the MS-DTYP ACL wire format, which must be zero [1].\n\nWhen building an ACL descriptor in build_sec_desc(), we are using a\nkmalloc()'ed descriptor buffer and writing the fields explicitly using\nle16() writes now. This never writes to the 2 byte reserved field,\nleaving it as uninitialized heap data.\n\nWhen the reserved field happens to contain non-zero slab garbage,\nSamba rejects the security descriptor with \"ndr_pull_security_descriptor\nfailed: Range Error\", causing chmod to fail with EINVAL.\n\nChange kmalloc() to kzalloc() to ensure the entire buffer is\nzero-initialized.\n\n\n[1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428"
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/smb/client/cifsacl.c"
                    ],
                    "versions": [
                        {
                            "version": "1593ddb37bd124c131fe635397df68e854a03108",
                            "lessThan": "4c3ed344a970aad51388ac3b0145b98318f0e21f",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "da087905e3270e2291c0afae39a28e7d183e5ec3",
                            "lessThan": "941a1e6eb35440336913afc88a82103291956d5d",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d",
                            "lessThan": "be1ef9512a3f5a755895c24f31b334342f4aa15b",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d",
                            "lessThan": "9bdb2ca31368b7671949dfb94a5d57ffccd01edd",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d",
                            "lessThan": "5e489c6c47a2ac15edbaca153b9348e42c1eacab",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "191f2f444745087c3c51fd6042a0e25f42315ab0",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "6.12.23",
                            "lessThan": "6.12.88",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.13.11",
                            "lessThan": "6.14",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/smb/client/cifsacl.c"
                    ],
                    "versions": [
                        {
                            "version": "6.14",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.14",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.88",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.30",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0.7",
                            "lessThanOrEqual": "7.0.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.1",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.12.23",
                                    "versionEndExcluding": "6.12.88"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "6.18.30"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "7.0.7"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "7.1"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13.11"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/4c3ed344a970aad51388ac3b0145b98318f0e21f"
                },
                {
                    "url": "https://git.kernel.org/stable/c/941a1e6eb35440336913afc88a82103291956d5d"
                },
                {
                    "url": "https://git.kernel.org/stable/c/be1ef9512a3f5a755895c24f31b334342f4aa15b"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9bdb2ca31368b7671949dfb94a5d57ffccd01edd"
                },
                {
                    "url": "https://git.kernel.org/stable/c/5e489c6c47a2ac15edbaca153b9348e42c1eacab"
                }
            ],
            "title": "smb: client: use kzalloc to zero-initialize security descriptor buffer",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}