CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers

Synopsis

An integer-overflow/pointer-wrap vulnerability exists in the Linux kernel SMB client's DACL (Discretionary Access Control List) parsing code. A malicious SMB server can send a crafted dacloffset value near the 32-bit unsigned integer maximum, causing pointer arithmetic to wrap below the end-of-buffer boundary and slip past subsequent bounds checks. Successful exploitation gives a remote attacker unauthenticated read, write, and crash capability against any host mounting an attacker-controlled SMB share. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target host over the network by acting as or controlling an SMB server that the victim host connects to.

• AuthenticationNot required

  No credentials are needed; the malicious server can deliver the crafted dacloffset in a normal unauthenticated or pre-auth SMB response before any privilege check on the client side matters.

• Victim interactionNot required

  No user action beyond the host having an SMB share mounted or an SMB connection initiated is necessary; the exploit is triggered by the server's response.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no race condition, memory-layout guessing, or other environmental precondition beyond a 32-bit kernel build mounting the attacker's share.

Blast Radius

• An attacker can read arbitrary kernel memory reachable through the wrapped DACL pointer, exposing credentials, session tokens, or other sensitive data held in kernel buffers.
• An attacker can write to arbitrary kernel memory via the chmod/chown rewrite paths in build_sec_desc() and id_mode_to_cifs_acl(), allowing modification of security descriptors, file permissions, or other persisted kernel structures.
• An attacker can crash the affected kernel by dereferencing an invalid pointer, causing a denial-of-service for all workloads on the host.
• On 32-bit kernel builds the impact is most direct, but any kernel build that follows the affected code paths is exposed to memory corruption with consequences up to full host compromise.