[LTS 9.6] smb (cifs): CVE-2026-46195, CVE-2026-46139, CVE-2026-43350, CVE-2026-31709; net: CVE-2026-31419

[pvts-mat]

[LTS 9.6]

CVE-2026-46195	VULN-188330
CVE-2026-46139	VULN-188852
CVE-2026-43350	VULN-184959
CVE-2026-31709	VULN-183470
CVE-2026-31419	VULN-181414

All smb-related CVE fixes are changes to a single file fs/smb/client/cifsacl.c.

Commits

CVE-2026-46195

smb: client: validate dacloffset before building DACL pointers

jira VULN-188330
cve CVE-2026-46195
commit-author Michael Bommarito <michael.bommarito@gmail.com>
commit f98b48151cc502ada59d9778f0112d21f2586ca3

CVE-2026-46139

smb: client: use kzalloc to zero-initialize security descriptor buffer

jira VULN-188852
cve CVE-2026-46139
commit-author Bjoern Doebel <doebel@amazon.de>
commit 5e489c6c47a2ac15edbaca153b9348e42c1eacab

CVE-2026-43350

smb: client: require a full NFS mode SID before reading mode bits

jira VULN-184959
cve CVE-2026-43350
commit-author Michael Bommarito <michael.bommarito@gmail.com>
commit 2757ad3e4b6f9e0fed4c7739594e702abc5cab21

CVE-2026-31709

smb: client: validate the whole DACL before rewriting it in cifsacl

jira VULN-183470
cve CVE-2026-31709
commit-author Michael Bommarito <michael.bommarito@gmail.com>
commit 0a8cf165566ba55a39fd0f4de172119dd646d39a
upstream-diff Usd linux-6.12.y backport
  d92f3f0b22414e7515696a02224d0af55e3004a3 for the clean pick

cifs: add validation check for the fields in smb_aces

jira VULN-183470
cve-pre CVE-2026-31709
commit-author Namjae Jeon <linkinjeon@kernel.org>
commit eeb827f2922eb07ffbf7d53569cc95b38272646f

cifs: fix incorrect validation for num_aces field of smb_acl

jira VULN-183470
cve-pre CVE-2026-31709
commit-author Namjae Jeon <linkinjeon@kernel.org>
commit aa2a739a75ab6f24ef72fb3fdb9192c081eacf06

Everything that the two prerequisites added to parse_dacl is later removed by the fixing commit 0a8cf16 so they aren't necessarily needed, but allow for clean cherry picks and simplify backporting.

CVE-2026-31419

net: bonding: fix use-after-free in bond_xmit_broadcast()

jira VULN-181414
cve CVE-2026-31419
commit-author Xiang Mei <xmei5@asu.edu>
commit 2884bf72fb8f03409e423397319205de48adca16
upstream-diff Used linux-6.12.y backport
  3453882f36c40d2339267093676585a89808a73d for a clean pick. That commit
  partially mixes in the ce7a381697cb3958ffe0b45e5028ac69444e9288 ("net:
  bonding: add broadcast_neighbor option for 802.3ad") which was not
  backported to LTS 9.6 neither

kABI check: passed

[0/1] kabi_check_kernel	Check ABI of kernel [ciqlts9_6-CVE-batch-38]	_kabi_check_kernel__x86_64--test--ciqlts9_6-CVE-batch-38
ninja explain: output state/kernels/ciqlts9_6-CVE-batch-38/x86_64/kabi_checked doesn't exist
ninja explain: state/kernels/ciqlts9_6-CVE-batch-38/x86_64/kabi_checked is dirty
+ dist_git_version=el-9.6
+ local_version=ciqlts9_6-CVE-batch-38
+ arch=x86_64
+ user=pvts
+ buildmachine=x86_64--build--ciqlts9_6
+ virsh_timeout=600
+ ssh_daemon_wait=20
+ src_dir=/mnt/code/kernel-dist-git-el-9.6
+ build_dir=/mnt/build_files/kernel-src-tree-ciqlts9_6-CVE-batch-38
+ sudo chmod +x /data/src/ctrliq-github-haskell/kernel-dist-git-el-9.6/SOURCES/check-kabi
+ ninja-back/virssh.xsh --max 8 --shutdown-on-success --shutdown-on-failure --timeout 600 --ssh-daemon-wait 20 pvts x86_64--build--ciqlts9_6 ''\''/mnt/code/kernel-dist-git-el-9.6/SOURCES/check-kabi'\'' -k '\''/mnt/code/kernel-dist-git-el-9.6/SOURCES/Module.kabi_x86_64'\'' -s '\''/mnt/build_files/kernel-src-tree-ciqlts9_6-CVE-batch-38/Module.symvers'\'''
kABI check passed
+ touch state/kernels/ciqlts9_6-CVE-batch-38/x86_64/kabi_checked

Boot test: passed

boot-test.log

Kselftests: passed relative

Reference

kselftests–ciqlts9_6–run1.log

Patch

kselftests–ciqlts9_6-CVE-batch-38–run1.log
kselftests–ciqlts9_6-CVE-batch-38–run2.log

Comparison

One test reported different status for the patched kernel, but it's not a regression (and not a progression either).

$ ktests.xsh diff -d kselftests*.log

Column    File
--------  --------------------------------------------
Status0   kselftests--ciqlts9_6--run1.log
Status1   kselftests--ciqlts9_6-CVE-batch-38--run1.log
Status2   kselftests--ciqlts9_6-CVE-batch-38--run2.log

TestCase                             Status0  Status1  Status2  Summary
net/forwarding:tc_flower_l2_miss.sh  fail     fail     pass     diff

full-test-results-comparison.log

[PlaidCat]

could you rebase to the latest 9.6 head?

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/28201918926

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit a6e58312a10 (net: bonding: fix use-after-free in bond_xmit_broadcast()) → upstream 2884bf72fb8f
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5320,16 +5320,12 @@
 				       struct net_device *bond_dev)
 {
 	struct bonding *bond = netdev_priv(bond_dev);
-	struct bond_up_slave *slaves;
+	struct slave *slave = NULL;
+	struct list_head *iter;
 	bool xmit_suc = false;
 	bool skb_used = false;
-	int slaves_count, i;
 
-	slaves = rcu_dereference(bond->all_slaves);
-
-	slaves_count = slaves ? READ_ONCE(slaves->count) : 0;
-	for (i = 0; i < slaves_count; i++) {
-		struct slave *slave = slaves->arr[i];
+	bond_for_each_slave_rcu(bond, slave, iter) {
 		struct sk_buff *skb2;
 
 		if (!(bond_slave_is_up(slave) && slave->link == BOND_LINK_UP))

• ⚠️ PR commit 3a037202426 (smb: client: validate the whole DACL before rewriting it in cifsacl) → upstream 0a8cf165566b
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/fs/smb/client/cifsacl.c
+++ b/fs/smb/client/cifsacl.c
@@ -868,11 +936,6 @@
 	if (num_aces > 0) {
 		umode_t denied_mode = 0;
 
-		if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) /
-				(offsetof(struct smb_ace, sid) +
-				 offsetof(struct smb_sid, sub_auth) + sizeof(__le16)))
-			return;
-
 		ppace = kmalloc_objs(struct smb_ace *, num_aces);
 		if (!ppace)
 			return;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/fs/smb/client/cifsacl.c
+++ b/fs/smb/client/cifsacl.c
@@ -763,5 +763,5 @@
 	int i;
-	int num_aces = 0;
+	u16 num_aces = 0;
 	int acl_size;
 	char *acl_base;
 	struct smb_ace **ppace;
@@ -805,8 +805,7 @@
 				 offsetof(struct smb_sid, sub_auth) + sizeof(__le16)))
 			return;
 
-		ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *),
-				      GFP_KERNEL);
+		ppace = kmalloc_objs(struct smb_ace *, num_aces);
 		if (!ppace)
 			return;
 
@@ -1660,6 +1659,6 @@
 		dacloffset = le32_to_cpu(pntsd->dacloffset);
 		if (dacloffset) {
 			dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
 			if (mode_from_sid)
 				nsecdesclen +=
-					le32_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace);
+					le16_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace);

This is an automated interdiff check for backported commits.

[github-actions]

JIRA PR Check Results

7 commit(s) with issues found:

Commit 482e59e87817

Summary: smb: client: validate dacloffset before building DACL pointers

❌ Errors:

• VULN-188330: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-188330: No time logged - please log time manually

Commit ea9d20aefdca

Summary: smb: client: use kzalloc to zero-initialize security descriptor buffer

❌ Errors:

• VULN-188852: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-188852: No time logged - please log time manually

Commit a049d3ae49f4

Summary: smb: client: require a full NFS mode SID before reading mode bits

❌ Errors:

• VULN-184959: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-184959: No time logged - please log time manually

Commit 3a0372024266

Summary: smb: client: validate the whole DACL before rewriting it in cifsacl

❌ Errors:

• VULN-183470: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-183470: No time logged - please log time manually

Commit 37ce2dd76497

Summary: cifs: add validation check for the fields in smb_aces

❌ Errors:

• VULN-183470: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-183470: No time logged - please log time manually

Commit 8e71f00957f2

Summary: cifs: fix incorrect validation for num_aces field of smb_acl

❌ Errors:

• VULN-183470: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-183470: No time logged - please log time manually

Commit a6e58312a103

Summary: net: bonding: fix use-after-free in bond_xmit_broadcast()

❌ Errors:

• VULN-181414: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-181414: No time logged - please log time manually

---

Summary: Checked 7 commit(s) total.

[github-actions]

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/28201918926

[PlaidCat]

[bmastbergen]

🥌