CVE-2026-31432

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31432", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.089Z", "datePublished": "2026-04-22T08:15:10.873Z", "dateUpdated": "2026-10-30T12:24:13.087Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:13.087Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445, directly reachable over the network by any remote SMB client.\nAC:L - The attacker reliably triggers the OOB write by crafting a compound request (e.g., READ + QUERY_INFO(Security)) where the first command consumes most of the response buffer. No race condition or special conditions are needed.\nPR:L - The QUERY_INFO command requires a valid SMB session (checked by smb2_check_user_session), a tree connect, and an open file handle. Even guest access requires completing session setup, so low privileges are needed.\nUI:N - No user interaction is required; the attacker sends the compound request directly to the ksmbd server.\nS:U - The vulnerability results in kernel heap corruption within the same security authority (the kernel); no security boundary such as a VM or sandbox is crossed.\nC:H - The heap buffer overflow writes past the kvzalloc'd response buffer into adjacent kernel heap objects. This OOB write can be leveraged to corrupt adjacent structures and create information disclosure primitives.\nI:H - The OOB write corrupts kernel heap memory with attacker-influenced data (security descriptor content including SIDs and ACEs derived from file ACLs), enabling potential control flow hijacking or arbitrary write primitives.\nA:H - The heap buffer overflow corrupts adjacent kernel data structures, reliably causing kernel crashes or panics."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c", "fs/smb/server/smbacl.c", "fs/smb/server/smbacl.h"], "versions": [{"version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77", "lessThan": "533f84264e28c54a79257ea87d2f94a0fcc9a611", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "850452af77f55d185f9445e1f7a1db53c5e4aad4", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "075ea208c648cc2bcd616295b711d3637c61de45", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "515c2daab46021221bdf406bef19bc90a44ec617", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "fda9522ed6afaec45cabc198d8492270c394c7bc", "status": "affected", "versionType": "git"}, {"version": "f2283680a80571ca82d710bc6ecd8f8beac67d63", "status": "affected", "versionType": "git"}, {"version": "6.1.71", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "5.15.145", "lessThan": "5.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c", "fs/smb/server/smbacl.c", "fs/smb/server/smbacl.h"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.71", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.145"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/533f84264e28c54a79257ea87d2f94a0fcc9a611"}, {"url": "https://git.kernel.org/stable/c/850452af77f55d185f9445e1f7a1db53c5e4aad4"}, {"url": "https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09"}, {"url": "https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45"}, {"url": "https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617"}, {"url": "https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc"}], "title": "ksmbd: fix OOB write in QUERY_INFO for compound requests", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c", "fs/smb/server/smbacl.c", "fs/smb/server/smbacl.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "533f84264e28c54a79257ea87d2f94a0fcc9a611", "status": "affected", "version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77", "versionType": "git"}, {"lessThan": "850452af77f55d185f9445e1f7a1db53c5e4aad4", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"lessThan": "d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"lessThan": "075ea208c648cc2bcd616295b711d3637c61de45", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"lessThan": "515c2daab46021221bdf406bef19bc90a44ec617", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"lessThan": "fda9522ed6afaec45cabc198d8492270c394c7bc", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"status": "affected", "version": "f2283680a80571ca82d710bc6ecd8f8beac67d63", "versionType": "git"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.71", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.145", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c", "fs/smb/server/smbacl.c", "fs/smb/server/smbacl.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B98C9201-BF17-4E2C-84FF-75EE2AA94DC5", "versionEndExcluding": "5.16", "versionStartIncluding": "5.15.145", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "163E72B5-0F5D-49E2-AAEA-F11E02D730AD", "versionEndExcluding": "6.2", "versionStartIncluding": "6.1.71", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D467CA25-2A1E-475C-969E-62759720CE35", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: correcci\u00f3n de escritura fuera de l\u00edmites en QUERY_INFO para solicitudes compuestas\n\nCuando se recibe una solicitud compuesta como READ + QUERY_INFO(Security), y el primer comando (READ) consume la mayor parte del b\u00fafer de respuesta, ksmbd podr\u00eda escribir m\u00e1s all\u00e1 del b\u00fafer asignado mientras construye un descriptor de seguridad.\n\nLa causa ra\u00edz fue que smb2_get_info_sec() verificaba el espacio del b\u00fafer usando ppntsd_size de xattr, mientras que build_sec_desc() a menudo sintetizaba un descriptor significativamente m\u00e1s grande a partir de ACL de POSIX.\n\nEste parche introduce smb_acl_sec_desc_scratch_len() para calcular con precisi\u00f3n el tama\u00f1o final del descriptor de antemano, realiza una verificaci\u00f3n adecuada del b\u00fafer con smb2_calc_max_out_buf_len(), y utiliza asignaci\u00f3n de tama\u00f1o exacto + fijaci\u00f3n de iov."}], "id": "CVE-2026-31432", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-22T09:16:21.410", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/533f84264e28c54a79257ea87d2f94a0fcc9a611"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/850452af77f55d185f9445e1f7a1db53c5e4aad4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: fix OOB write in QUERY_INFO for compound requests", "id": "2460537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460537"}, "csaw": false, "cwe": "CWE-131", "details": ["A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an attacker to cause the system to write data beyond its intended memory boundaries when processing specific network requests. Specifically, when a complex request combines data reading with security information queries, the system might miscalculate the required buffer size. This out-of-bounds write could lead to system instability, a denial of service, or potentially allow an attacker to execute malicious code."], "name": "CVE-2026-31432", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31432\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31432\nhttps://lore.kernel.org/linux-cve-announce/2026042216-CVE-2026-31432-e990@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,075ea208c648cc2bcd616295b711d3637c61de45)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,515c2daab46021221bdf406bef19bc90a44ec617)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,fda9522ed6afaec45cabc198d8492270c394c7bc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f2283680a80571ca82d710bc6ecd8f8beac67d63"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-22T09:30:13.308109+00:00", "updated": "2026-05-21T19:15:20.184685+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}