CVE-2026-31707
Integer Overflow in Linux Kernel ksmbd
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.13 (inc) to 6.18.25 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.2 (exc) |
| linux | linux_kernel | From 5.15 (inc) to 6.12.84 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ksmbd component, specifically in the ipc_validate_msg() function that validates response sizes. The function calculates expected message sizes by adding or multiplying attacker-controlled fields from daemon responses to fixed structure sizes using unsigned integer arithmetic. Three cases can cause integer overflow: KSMBD_EVENT_RPC_REQUEST, KSMBD_EVENT_SHARE_CONFIG_REQUEST, and KSMBD_EVENT_LOGIN_REQUEST_EXT.
The overflow occurs because resp->payload_sz and resp->ngroups fields, which are attacker-controlled, can wrap around the unsigned integer limit or convert negative values to very large unsigned values. This causes the computed message size (msg_sz) to wrap and potentially match an expected size, bypassing size checks. As a result, downstream code trusts unverified lengths, leading to potential memory corruption or other issues.
The fix involves using overflow checks (check_add_overflow()) on the first two cases and rejecting out-of-range values for ngroups in the third case to prevent overflow and ensure message sizes are properly validated.
How can this vulnerability impact me? :
This vulnerability can lead to integer overflow in message size validation, allowing an attacker to bypass size checks and cause the system to trust incorrect message lengths. This can result in memory corruption, such as buffer overflows or improper memory allocations, potentially leading to denial of service, information disclosure, or arbitrary code execution within the Linux kernel's ksmbd service.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is addressed by validating response sizes in the ipc_validate_msg() function within the ksmbd component of the Linux kernel.
Immediate mitigation involves ensuring that the kernel version in use includes the fix that applies check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST paths to detect integer overflow without limiting functional payload size.
Additionally, for LOGIN_REQUEST_EXT responses, the fix rejects resp->ngroups values outside the signed [0, NGROUPS_MAX] range early, preventing overflow.
Therefore, the recommended immediate step is to update the Linux kernel to a version that contains this fix.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves integer overflow in the ksmbd daemon's response size validation in the Linux kernel. Detection would require monitoring or analyzing ksmbd responses for abnormal or suspicious message sizes that could indicate an overflow.
Since the vulnerability is in kernel code related to ksmbd's IPC message validation, direct detection on the network or system using simple commands is not straightforward from the provided information.
No specific detection commands or tools are provided in the available context or resources.