CVE-2026-31704: ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: use checkaddoverflow() to prevent u16 DACL size overflow
setposixaclentriesdacl() and setntacldacl() accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causing the pointer arithmetic (char )pndace + size to land within already-written ACEs. Subsequent writes then overwrite earlier entries, and pndacl->size gets a truncated value.
Use checkaddoverflow() at each accumulation point to detect the wrap before it corrupts the buffer, consistent with existing checkmuloverflow() usage elsewhere in smbacl.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Apply a code-level fix to ksmbd that uses check_add_overflow() at each accumulation point when computing DACL/ACE sizes: modify set_posix_acl_entries_dacl() and set_ntacl_dacl() so that the u16 accumulations of ACE sizes are checked with check_add_overflow() to detect and prevent wraparound before writing the buffer.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31704?
CVE-2026-31704 is classified with a moderate severity level due to its potential impact on Linux kernel security.
How do I fix CVE-2026-31704?
To fix CVE-2026-31704, upgrade to the Linux kernel version that includes the patch for this vulnerability.
Which software is affected by CVE-2026-31704?
CVE-2026-31704 affects the ksmbd component of the Linux kernel across several versions.
What is the nature of CVE-2026-31704?
CVE-2026-31704 involves an overflow vulnerability in DACL size handling in the Linux kernel's ksmbd implementation.
When was CVE-2026-31704 disclosed?
CVE-2026-31704 was disclosed in 2026 as part of ongoing security improvements to the Linux kernel.