CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op()

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's SMB client, specifically in the smb2_compound_op() function. The flaw is reachable over the network without authentication: a malicious or compromised SMB server can send a truncated response with an oversized OutputBufferLength field, causing a memcpy() call to read past the end of a kernel heap allocation and leak adjacent memory. Successful exploitation discloses sensitive kernel heap contents and can crash the affected service. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SMB client over the network by operating or controlling an SMB server that the vulnerable client connects to.

• AuthenticationNot required

  No authentication is required; the malicious server triggers the read before any credential exchange by the client is necessary.

• Victim interactionNot required

  No victim interaction beyond an existing SMB client connection is needed; the server-side response alone triggers the vulnerable code path.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and does not depend on race conditions, memory layout randomization, or other environmental preconditions.

Blast Radius

• Reads adjacent kernel heap memory, which can expose in-flight credentials, session tokens, or other sensitive data structures held in kernel memory.
• Causes a service disruption by corrupting internal state or triggering a kernel panic, taking down the affected host or container.
• Any process or workload sharing the affected kernel is exposed, not just the SMB client process that initiated the connection.
• Kernel heap leaks can be chained with a separate write primitive to achieve further privilege escalation on the host.