CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix OOB read in smb2ioctlqueryinfo QUERYINFO path
smb2ioctlqueryinfo() has two response-copy branches: PASSTHRUFSCTL and the default QUERYINFO path. The QUERYINFO branch clamps qi.inputbufferlength to the server-reported OutputBufferLength and then copies qi.inputbufferlength bytes from qirsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fits within rspiov[1].iovlen.
A malicious server can return OutputBufferLength larger than the actual QUERYINFO response, causing copytouser() to walk past the response buffer and expose adjacent kernel heap to userspace.
Guard the QUERYINFO copy with a bounds check on the actual Buffer payload. Use structsize(qirsp, Buffer, qi.inputbufferlength) rather than an open-coded addition so the guard cannot overflow on 32-bit builds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In smb2_ioctl_query_info()’s QUERY_INFO branch, guard the QUERY_INFO copy with a bounds check that uses struct_size(qi_rsp, Buffer, qi.input_buffer_length) and use the default QUERY_INFO path. Ensure the flexible-array payload actually fits in the response before copying to userspace.
Linux kernel (smb2_ioctl_query_info) QUERY_INFO response path bounds check for QUERY_INFO flexible-array payload using struct_size(qi_rsp, Buffer, qi.input_buffer_length) = Use struct_size(qi_rsp, Buffer, qi.input_buffer_length) and the default QUERY_INFO path instead of open-coded addition - Configuration
In smb2_ioctl_query_info(), clamp qi.input_buffer_length to the server-reported OutputBufferLength, and compute rsp_iov[1].iov_len without open-coded addition so the guard cannot overflow (the text specifies this is done rather than open-coded addition so the guard cannot overflow on rsp_iov[1].iov_len).
Linux kernel (smb2_ioctl_query_info) PASSTHRU_FSCTL / QUERY_INFO response-copy logic avoid overflow when clamping by server-reported OutputBufferLength = Rather than open-coded addition, clamp qi.input_buffer_length to server-reported OutputBufferLength and use guarded sizing for rsp_iov[1].iov_len
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31708?
CVE-2026-31708 is classified with a high severity rating due to its potential to allow an out-of-bounds read.
How do I fix CVE-2026-31708?
To fix CVE-2026-31708, update to the latest stable version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2026-31708?
CVE-2026-31708 affects the Linux kernel, particularly versions where the smb2_ioctl_query_info function is used.
What type of vulnerability is CVE-2026-31708?
CVE-2026-31708 is categorized as an out-of-bounds read vulnerability in the Linux kernel's SMB client.
Is CVE-2026-31708 being actively exploited?
As of now, there are no specific reports indicating that CVE-2026-31708 is being actively exploited in the wild.