CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix off-by-8 bounds check in checkwsleas()
The bounds check uses (u8 )ea + nlen + 1 + vlen as the end of the EA name and value, but eadata sits at offset sizeof(struct smb2filefulleainfo) = 8 from ea, not at offset 0. The strncmp() later reads ea->eadata[0..nlen-1] and the value bytes follow at eadata[nlen+1..nlen+vlen], so the actual end is ea->eadata + nlen + 1 + vlen. Isn't pointer math fun?
The earlier check (u8 )ea > end - sizeof(ea) only guarantees the 8-byte header is in bounds, but since the last EA is placed within 8 bytes of the end of the response, the name and value bytes are read past the end of iov.
Fix this mess all up by using ea->eadata as the base for the bounds check.
An "untrusted" server can use this to leak up to 8 bytes of kernel heap into the EA name comparison and influence which WSL xattr the data is interpreted as.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31614?
The severity of CVE-2026-31614 is assessed as high due to the potential for exploitation in the Linux kernel.
How do I fix CVE-2026-31614?
To fix CVE-2026-31614, it is recommended to update your Linux kernel to the latest patched version.
What are the affected versions for CVE-2026-31614?
CVE-2026-31614 affects various versions of the Linux kernel, specifically between 6.6.32 to 6.6.136, 6.9 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, and 7.0 to 7.0.1.
What causes CVE-2026-31614?
CVE-2026-31614 is caused by an off-by-8 bounds check error in the 'check_wsl_eas()' function within the Linux kernel.
Is CVE-2026-31614 remotely exploitable?
CVE-2026-31614 may be exploitable remotely depending on the environment and configuration of the affected Linux systems.