CVE-2026-31708
Out-of-Bounds Read in Linux Kernel SMB Client
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.7 (inc) to 6.12.84 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.25 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.2 (exc) |
| linux | linux_kernel | From 5.1 (inc) to 6.6.136 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's SMB client, specifically in the smb2_ioctl_query_info function. The function has two response-copy branches, and in the QUERY_INFO path, it copies data from the server response to userspace without properly verifying that the data fits within the expected buffer size.
A malicious SMB server can exploit this by returning a larger OutputBufferLength than the actual response size, causing the kernel to read beyond the intended buffer (an out-of-bounds read). This results in exposing adjacent kernel heap memory to userspace, potentially leaking sensitive kernel data.
The fix involves adding a proper bounds check on the actual buffer payload to prevent this out-of-bounds read, ensuring the copy operation does not exceed the real buffer size.
How can this vulnerability impact me? :
This vulnerability can lead to information disclosure by allowing a malicious SMB server to cause the Linux kernel to leak adjacent kernel heap memory to userspace. This could expose sensitive kernel data or other information that should remain protected.
Such exposure could be leveraged by attackers to gain insights into kernel memory layout or other sensitive information, potentially aiding further attacks or privilege escalation.