{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: validate dacloffset before building DACL pointers\\n\\nparse_sec_desc(), build_sec_desc(), and the chown path in\\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\\nbefore proving a DACL header fits inside the returned security\\ndescriptor.\\n\\nOn 32-bit builds a malicious server can return dacloffset near\\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\\npast the later pointer-based bounds checks. build_sec_desc() and\\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\\npointer in the chmod\/chown rewrite paths.\\n\\nValidate dacloffset numerically before building any DACL pointer and\\nreuse the same helper at the three DACL entry points.”,”published”:”2026-05-28T09:36:48.259Z”,”modified”:”2026-05-30T10:48:55.662Z”,”type”:”cve”,”title”:”smb: client: validate dacloffset before building DACL pointers”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/ba7f71b6161c0943dafc367565e5843d16b7d505\\nhttps:\/\/git.kernel.org\/stable\/c\/3b1ddba19e77ee35241cd27f16dc3e8d14e08db7\\nhttps:\/\/git.kernel.org\/stable\/c\/c688f3ed73d31943334ad2139cb02ec49664322a\\nhttps:\/\/git.kernel.org\/stable\/c\/8bd07e417b6bda67e317920584e48cb6ee442a8a\\nhttps:\/\/git.kernel.org\/stable\/c\/f98b48151cc502ada59d9778f0112d21f2586ca3″,”id”:”CVE-2026-46195″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\\nLinux Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\\nLinux Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\\nLinux Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\\nLinux Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4\\nLinux Linux 5.12″,”sourceHref”:””,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”bc3e9dd9d104ca1b75644eab87b38ce8a924aef4″,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: validate dacloffset before building DACL pointers\\n\\nparse_sec_desc(), build_sec_desc(), and the chown path in\\nid_mode_to_cifs_acl() all add…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,35,12,13,7,11,5],"class_list":["post-58516","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n