CVE-2026-31432
Out-of-Bounds Write in Linux ksmbd QUERY_INFO Handling
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | ksmbd | * |
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ksmbd component, specifically in handling compound requests like READ + QUERY_INFO(Security). When the first command (READ) uses most of the response buffer, ksmbd may write beyond the allocated buffer while constructing a security descriptor.
The root cause is that the function smb2_get_info_sec() checked buffer space based on a size from extended attributes (ppntsd_size), but the actual security descriptor built by build_sec_desc() could be much larger due to POSIX ACLs. This mismatch led to out-of-bounds writes.
The fix involved accurately computing the final descriptor size before allocation, performing proper buffer size checks, and using exact-sized allocation with iov pinning to prevent writing beyond the buffer.
How can this vulnerability impact me? :
This vulnerability can cause out-of-bounds memory writes in the ksmbd service of the Linux kernel when processing certain compound SMB requests. Such memory corruption can lead to system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges.