ACK: [SRU][Q][PATCH 0/1] CVE-2026-46155

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 09:22, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-46155
>
> [ Impact ]
>
> A flaw exists in the SMB client when handling compound operations that query
> WSL extended attributes. If a malicious or buggy server sends a truncated
> response with a large OutputBufferLength and terminates the EA list early,
> check_wsl_eas() returns success without verifying that the entire
> OutputBufferLength fits within the actual buffer length (iov_len). The
> subsequent memcpy() in smb2_compound_op() then reads beyond the end of the
> rsp_iov allocation, leaking adjacent kernel heap memory. This out-of-bounds
> read carries a CVSS score of 9.1.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> Any regression would be confined to the SMB/CIFS client subsystem, specifically
> the parsing of WSL extended attributes in compound operations. An incorrect fix
> could reject valid EA responses or break access to WSL-backed files on SMB
> mounts.
>