CVE-2026-46139

Technical summary

CVE-2026-46139 stems from a memory initialization gap introduced by commit 62e7dd0a39c2d, which restructured the smb_acl struct's num_aces field from a single 32-bit little-endian integer into two 16-bit fields: num_aces (__le16) and reserved (__le16). The reserved field corresponds to the Sbz2 (SHOULD be zero) field in MS-DTYP ACL wire format. The build_sec_desc() function allocates a descriptor buffer using kmalloc() and explicitly writes le16 values for individual fields, but never explicitly zeroes the reserved field. Because kmalloc() returns uninitialized heap memory, the reserved bytes retain whatever data was previously on the heap. SMB protocol implementations validate that Sbz2 equals zero; when it does not, validation fails with a range error. The kernel's SMB client then propagates this as EINVAL to user space, causing chmod and similar operations to fail. Replacing kmalloc() with kzalloc() ensures the entire buffer is zero-initialized on allocation, satisfying the protocol requirement.

Business impact

Systems using Linux SMB client functionality—particularly in multi-user or NAS environments relying on SMB/CIFS shares for permission management—may experience intermittent failures when attempting to modify file or directory permissions. Users encounter seemingly random EINVAL errors during chmod operations, eroding operational predictability and creating support overhead. The non-deterministic nature (depends on heap state) makes troubleshooting difficult. While availability impact is localized to permission management operations rather than data loss or confidentiality breach, the unpredictable failures can disrupt workflows in file-sharing and collaborative environments.

Affected systems

The vulnerability affects the Linux kernel across all active versions that include the affected SMB client code. The vulnerability was introduced by commit 62e7dd0a39c2d and persists until patched. Affected systems include any Linux distribution that uses the kernel's native SMB client (as opposed to userspace Samba), particularly in network-attached storage deployments, containerized environments with SMB mounts, and hybrid enterprises with Linux-to-Windows file sharing. Kernel versions prior to the fix are at risk; consult your distribution's advisory for specific version ranges.

Exploitability

This is not an exploitable vulnerability in the traditional sense. There is no remote attack vector, no privilege escalation path, and no mechanism for an attacker to trigger the flaw remotely. The vulnerability manifests as a local availability issue triggered naturally during normal file permission operations. Exploitation requires no special skills or tools—it occurs probabilistically when heap memory happens to contain non-zero garbage in the reserved field. No public exploit code exists, and the KEV catalog does not list it as actively exploited. The low exploitability reflects the benign attack surface: this is a data validation bug, not a memory corruption or unauthorized access flaw.

Remediation

Apply the kernel patch that changes kmalloc() to kzalloc() in the build_sec_desc() function. This one-line change ensures the security descriptor buffer is zero-initialized at allocation, guaranteeing the reserved field meets the SMB protocol requirement. Verify the patch against your kernel version and distribution advisory. No workarounds exist beyond patching; permission operations will continue to fail intermittently until the kernel is updated. Systems should prioritize updating to a kernel version that includes this fix.

Patch guidance

Obtain the patch from your Linux distribution's security advisory or upstream kernel tree. The fix involves replacing the kmalloc() call in the SMB client code with kzalloc(). Distributions have likely backported this fix into currently supported kernel versions. Check your vendor's security bulletin for the patched kernel version for your distribution and release. After applying the patch, rebuild or update the kernel and reboot. No configuration changes or manual steps are required beyond updating to the patched kernel version.

Detection guidance

Monitor system logs for repeated EINVAL errors during chmod or setfacl operations on SMB-mounted filesystems. Look for patterns where permission modifications fail sporadically but subsequent retries may succeed (indicating heap-state dependency). Enable SMB client debugging if your system supports it to capture protocol-level validation failures. Network-based detection is difficult because the failure occurs in kernel memory allocation, not on the wire; focus on endpoint logging. After patching, the absence of these errors confirms remediation.

Why prioritize this

Prioritize patching based on operational impact rather than severity score. Systems heavily dependent on SMB file sharing and permission management—NAS appliances, enterprise file servers, containerized deployments—should patch promptly to eliminate intermittent chmod failures. The CVSS 5.5 MEDIUM score reflects availability impact only; the actual user-facing disruption may warrant higher internal priority if file-sharing reliability is critical to your operations. Non-exploitability and lack of active attacks mean this is not an emergency patch, but it should be included in the next standard kernel maintenance window.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (system access required), Attack Complexity Low (no special conditions), Privileges Required (user-level SMB access), no User Interaction needed, unchanged Scope, no Confidentiality or Integrity impact, and high Availability impact (permission operations fail). The score captures the operational disruption caused by intermittent failures but does not reflect exploitability—this is a reliability bug, not a security vulnerability in the traditional threat model. The score appropriately downgrades the perceived urgency compared to remotely exploitable flaws, though operational teams may weight the disruption more heavily.

Frequently asked questions