CVE-2026-31611: ksmbd: require 3 sub-authorities before reading sub_auth[2]
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: require 3 sub-authorities before reading subauth[2]
parsedacl() compares each ACE SID against sidunixNFSmode and on match reads sid.subauth[2] as the file mode. If sidunixNFSmode is the prefix S-1-5-88-3 with numsubauth = 2 then comparesids() compares only min(numsubauth, 2) sub-authorities so a client SID with numsubauth = 2 and subauth = {88, 3} will match.
If numsubauth = 2 and the ACE is placed at the very end of the security descriptor, subauth[2] will be 4 bytes past endofacl. The out-of-band bytes will then be masked to the low 9 bits and applied as the file's POSIX mode, probably not something that is good to have happen.
Fix this up by forcing the SID to actually carry a third sub-authority before reading it at all.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (ksmbd)to a version that resolves this vulnerability.Patch ksmbd: require 3 sub-authorities before reading sub_auth[2] - Configuration
Update/patch ksmbd behavior so it requires 3 sub-authorities before reading sid.sub_auth[2] (prevents out-of-bounds read when num_subauth=2 at end of ACL).
ksmbd (Linux kernel) require 3 sub-authorities before reading sub_auth[2] = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31611?
CVE-2026-31611 has been classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2026-31611?
To address CVE-2026-31611, update your Linux kernel to a version that includes the relevant security patch.
Which versions of the Linux kernel are affected by CVE-2026-31611?
CVE-2026-31611 affects Linux kernel versions between 5.15 and 6.6.136, 6.7 and 6.12.83, 6.13 and 6.18.24, 6.19 and 6.19.14, and 7.0 and 7.0.1.
What components are involved in CVE-2026-31611?
CVE-2026-31611 involves the ksmbd component of the Linux kernel, specifically related to access control list handling.
Is there a workaround for CVE-2026-31611?
Currently, the recommended action for CVE-2026-31611 is to update to a non-vulnerable kernel version, as there are no confirmed workarounds.