CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data()

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's SMB client, specifically in the symlink_data() function of the SMB2 protocol handler. The flaw is reachable over the network without any authentication, allowing a malicious or compromised SMB server to send a crafted symlink error response that triggers the read past the end of a buffer. Successful exploitation exposes sensitive kernel memory contents and can crash the affected system. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target system's SMB client over the network by acting as or controlling a reachable SMB server.

• AuthenticationNot required

  No credentials are required; the malicious server can trigger the out-of-bounds read against any connecting client without authentication.

• Victim interactionNot required

  No user interaction is needed; the kernel SMB client processes the crafted server response automatically during a symlink lookup.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental configuration to succeed.

Blast Radius

• An attacker reads out-of-bounds kernel memory contents, which may include sensitive data such as cryptographic material, session tokens, or kernel pointers from neighboring heap or stack regions.
• The out-of-bounds read can produce a kernel panic or oops, crashing the affected host and taking down all workloads running on it.
• A crash loop triggered by repeated malformed responses can render the system unavailable until it is manually recovered or rebooted.
• Leaked kernel pointers from the out-of-bounds read can weaken address-space layout randomization, lowering the barrier for follow-on exploitation.