CVE-2026-31432
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability has been identified in the Linux kernel that allowed for out-of-bounds writes when processing compound requests in ksmbd. The issue occurred when the first command in a request consumed most of the response buffer, leading to errors in building the security descriptor.
Risk Assessment
This vulnerability could lead to unauthorized memory access, posing risks to the integrity and confidentiality of data within the system. Organizations should be aware of potential attacks that may exploit this flaw.
Recommendation
It is recommended to update the Linux kernel to the latest version where fixes for this vulnerability have been implemented. Additionally, monitoring system logs for potential exploitation attempts is advisable.
Other vulnerabilities in Linux kernel (ksmbd)
See all- CVE-2026-43376Critical
A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.
- CVE-2023-54203Critical
In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.
- CVE-2023-38432Critical
An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.
- CVE-2023-38431Critical
An issue was discovered in the Linux kernel before 6.3.8 related to the lack of validation of the NetBIOS header's length in relation to SMB header sizes in ksmbd. This leads to an out-of-bounds read.
- CVE-2023-38427Critical
An issue was discovered in the Linux kernel before 6.3.8 related to integer underflow and out-of-bounds read in the deassemble_neg_contexts function in fs/smb/server/smb2pdu.c in ksmbd.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as READ + QUERY_INFO(Security) is received, and the first command (READ) consumes most of the response buffer, ksmbd could write beyond the allocated buffer while building a security descriptor. The root cause was that smb2_get_info_sec() checked buffer space using ppntsd_size from xattr, while build_sec_desc() often synthesized a significantly larger descriptor from POSIX ACLs. This patch introduces smb_acl_sec_desc_scratch_len() to accurately compute the final descriptor size beforehand, performs proper buffer checking with smb2_calc_max_out_buf_len(), and uses exact-sized allocation + iov pinning.