[SRU][Q][PATCH 0/1] CVE-2026-46155

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-46155

[ Impact ]

A flaw exists in the SMB client when handling compound operations that query
WSL extended attributes. If a malicious or buggy server sends a truncated
response with a large OutputBufferLength and terminates the EA list early,
check_wsl_eas() returns success without verifying that the entire
OutputBufferLength fits within the actual buffer length (iov_len). The
subsequent memcpy() in smb2_compound_op() then reads beyond the end of the
rsp_iov allocation, leaking adjacent kernel heap memory. This out-of-bounds
read carries a CVSS score of 9.1.

[ Fix ]

questing: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

Any regression would be confined to the SMB/CIFS client subsystem, specifically
the parsing of WSL extended attributes in compound operations. An incorrect fix
could reject valid EA responses or break access to WSL-backed files on SMB
mounts.