In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix out-of-bounds read in symlink_data()

Since smb2_check_message() returns success without length validation for
the symlink error response, in symlink_data() it is possible for
iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer
only contains the base SMB2 header (64 bytes), accessing
err->ErrorContextCount (at offset 66) or err->ByteCount later in
symlink_data() will cause an out-of-bounds read.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
76894f3e2f71177747b8b4763fb180e800279585 affected < ef6495d4df6e7af8f3de67e65150881c880f696c
76894f3e2f71177747b8b4763fb180e800279585 affected < 15dc0a4de743a1aaa7b859b3aea79f08c695396c
76894f3e2f71177747b8b4763fb180e800279585 affected < b8c8a704f0bc133deb171f6aeb6f3a684203e212
76894f3e2f71177747b8b4763fb180e800279585 affected < b9561402489d41149f63e001a74384863b7b30a6
76894f3e2f71177747b8b4763fb180e800279585 affected < d62b8d236fab503c6fec1d3e9a38bea71feaca20
2d046892a493d9760c35fdaefc3017f27f91b621 affected —
6.0.16 affected < 6.1
Linux Linux affected
Version Status Constraints
6.1 affected —
0 unaffected < 6.1
6.6.140 unaffected ≤ 6.6.*
6.12.88 unaffected ≤ 6.12.*
6.18.30 unaffected ≤ 6.18.*
7.0.7 unaffected ≤ 7.0.*
7.1-rc3 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/15dc0a4de743a1aaa7b859b3aea79f08c695396c cve-icon cve-icon
https://git.kernel.org/stable/c/b8c8a704f0bc133deb171f6aeb6f3a684203e212 cve-icon cve-icon
https://git.kernel.org/stable/c/b9561402489d41149f63e001a74384863b7b30a6 cve-icon cve-icon
https://git.kernel.org/stable/c/d62b8d236fab503c6fec1d3e9a38bea71feaca20 cve-icon cve-icon
https://git.kernel.org/stable/c/ef6495d4df6e7af8f3de67e65150881c880f696c cve-icon cve-icon
History

Thu, 28 May 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-20

Thu, 28 May 2026 10:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer only contains the base SMB2 header (64 bytes), accessing err->ErrorContextCount (at offset 66) or err->ByteCount later in symlink_data() will cause an out-of-bounds read.
Title smb/client: fix out-of-bounds read in symlink_data()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-28T09:36:39.318Z

Reserved: 2026-05-13T15:03:33.103Z

Link: CVE-2026-46185

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-28T10:16:34.117

Modified: 2026-05-28T13:44:01.663

Link: CVE-2026-46185

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-28T12:15:21Z

Weaknesses