CVE-2026-31432: ksmbd: fix OOB write in QUERY_INFO for compound requests
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix OOB write in QUERYINFO for compound requests
When a compound request such as READ + QUERYINFO(Security) is received, and the first command (READ) consumes most of the response buffer, ksmbd could write beyond the allocated buffer while building a security descriptor.
The root cause was that smb2getinfosec() checked buffer space using ppntsdsize from xattr, while buildsecdesc() often synthesized a significantly larger descriptor from POSIX ACLs.
This patch introduces smbaclsecdescscratchlen() to accurately compute the final descriptor size beforehand, performs proper buffer checking with smb2calcmaxoutbuflen(), and uses exact-sized allocation + iov pinning.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31432?
CVE-2026-31432 has been classified with moderate severity due to potential out-of-bounds write vulnerabilities.
How do I fix CVE-2026-31432?
To fix CVE-2026-31432, update the Linux kernel to the latest version that addresses the out-of-bounds write issue in ksmbd.
Which systems are affected by CVE-2026-31432?
CVE-2026-31432 affects systems running ksmbd in the Linux kernel when handling compound requests.
Can CVE-2026-31432 be exploited remotely?
Yes, CVE-2026-31432 could potentially be exploited remotely if an attacker crafts specific compound requests.
What should I do if I am vulnerable to CVE-2026-31432?
If vulnerable to CVE-2026-31432, it is important to patch your system as soon as a fix is available from your Linux distribution.