CVE-2026-31712
Buffer Out-of-Bounds Read in ksmbd SMB Server
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.13 (inc) to 6.18.25 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.2 (exc) |
| linux | linux_kernel | From 5.15 (inc) to 6.12.84 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ksmbd component, specifically in the smb_check_perm_dacl() function. The issue arises because the function does not properly validate the size of Access Control Entries (ACEs) in a Discretionary Access Control List (DACL). While it checks if the remaining buffer is large enough, it does not ensure that the declared size of an ACE is at least as large as the structure it represents.
An attacker who can set a crafted DACL on a file they own can create an ACE with a declared size smaller than the actual structure size, bypassing the checks. This leads to out-of-bounds (OOB) reads when the kernel later processes the DACL during file creation, potentially reading memory beyond the intended bounds.
The vulnerability is triggered by an authenticated SMB client with permission to set an ACL on a file. The OOB read is not reflected back to the attacker and is not pre-authentication, but it can cause kernel address sanitizer (KASAN) reports and kernel state corruption.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an authenticated SMB client with permission to set an ACL on a file to cause out-of-bounds memory reads in the kernel. While the attacker cannot directly exploit this to gain code execution or leak information, the OOB read can lead to kernel state corruption or trigger kernel address sanitizer (KASAN) alerts.
Kernel state corruption can cause system instability, crashes, or unpredictable behavior, potentially affecting system availability and reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an out-of-bounds read triggered by a crafted DACL set by an authenticated SMB client on a file they own. Detection would involve monitoring for abnormal kernel behavior or KASAN reports indicating out-of-bounds reads related to smb_check_perm_dacl().
Since the vulnerability is triggered during a CREATE operation on a file with a malicious DACL, detection could include auditing SMB ACL changes and subsequent file CREATE operations.
However, no specific detection commands or network signatures are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by tightening validation in smb_check_perm_dacl() to require a minimum ACE size and reject malformed ACEs before dereferencing pointers.
Immediate mitigation steps include applying the updated Linux kernel patch that fixes this issue.
Additionally, restricting SMB clients' ability to set ACLs on files or limiting access to trusted users may reduce risk until the patch is applied.