{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31712", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.133Z", "datePublished": "2026-05-01T13:56:08.583Z", "dateUpdated": "2026-08-05T12:24:46.463Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:46.463Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require minimum ACE size in smb_check_perm_dacl()\n\nBoth ACE-walk loops in smb_check_perm_dacl() only guard against an\nunder-sized remaining buffer, not against an ACE whose declared\n`ace->size` is smaller than the struct it claims to describe:\n\n if (offsetof(struct smb_ace, access_req) > aces_size)\n break;\n ace_size = le16_to_cpu(ace->size);\n if (ace_size > aces_size)\n break;\n\nThe first check only requires the 4-byte ACE header to be in bounds;\nit does not require access_req (4 bytes at offset 4) to be readable.\nAn attacker who has set a crafted DACL on a file they own can declare\nace->size == 4 with aces_size == 4, pass both checks, and then\n\n granted |= le32_to_cpu(ace->access_req); /* upper loop */\n compare_sids(&sid, &ace->sid); /* lower loop */\n\nreads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at\noffset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES\n* 4 bytes).\n\nTighten both loops to require\n\n ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE\n\nwhich is the smallest valid on-wire ACE layout (4-byte header +\n4-byte access_req + 8-byte sid base with zero sub-auths). Also\nreject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES\nbefore letting compare_sids() dereference sub_auth[] entries.\n\nparse_sec_desc() already enforces an equivalent check (lines 441-448);\nsmb_check_perm_dacl() simply grew weaker validation over time.\n\nReachability: authenticated SMB client with permission to set an ACL\non a file. On a subsequent CREATE against that file, the kernel\nwalks the stored DACL via smb_check_perm_dacl() and triggers the\nOOB read. Not pre-auth, and the OOB read is not reflected to the\nattacker, but KASAN reports and kernel state corruption are\npossible." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 8.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - ksmbd is an in-kernel SMB server reachable over the network via SMB2/SMB3 requests, typically TCP/445. The vulnerable DACL walk is reached from remote SMB CREATE processing after a crafted stored ACL is present.\nAC:L - No race or uncontrollable timing is required; an attacker can set a malformed DACL and then trigger a subsequent CREATE against that file. ACL xattr support is a reasonable ksmbd deployment configuration, not an exploit-complexity barrier.\nPR:L - The path is not pre-authentication: SMB2 commands require a valid authenticated session and tree connect. The attacker needs ordinary SMB credentials with permission to set an ACL on a file they control, not kernel/root privileges.\nUI:N - After authentication, the attacker can send the ACL-setting and CREATE requests directly. No victim user action is required.\nS:U - The impact remains within the kernel/ksmbd host security authority. There is no VM, IOMMU, or sandbox boundary crossing.\nC:H - The bug causes attacker-triggered out-of-bounds reads from kernel heap data beyond the stored security descriptor, including SID fields. Although not directly reflected, this is more than a strictly bounded few-byte read and the higher-severity rule makes High appropriate.\nI:L - The out-of-bounds data is consumed as permission-check state such as ACE access bits, so it can corrupt ksmbd access-control decisions for the requested object. There is no clear arbitrary kernel write or control-flow hijack primitive, so the integrity impact is limited rather than High.\nA:H - The malformed ACE can reliably trigger kernel out-of-bounds reads during SMB CREATE, producing KASAN reports and possible kernel oops/panic depending on configuration. A remote authenticated user can repeat the trigger for denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/smbacl.c" ], "versions": [ { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "282cbbb476b9f35793452bc461934af4c7eca169", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "f20adc4ef7428bc485ee83fd1a592252fb87718b", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "325d4ac11f526cb8964cff14548ccf02d8c756d8", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "90089584b2e25c4510b7b987387b4405f0673ece", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "151b1799861fde38087c08f613abc2843ef597b0", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "d07b26f39246a82399661936dd0c853983cfade7", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/smbacl.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.84", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.25", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.2", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.210" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.176" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.140" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.84" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.25" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.0.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/282cbbb476b9f35793452bc461934af4c7eca169" }, { "url": "https://git.kernel.org/stable/c/f20adc4ef7428bc485ee83fd1a592252fb87718b" }, { "url": "https://git.kernel.org/stable/c/325d4ac11f526cb8964cff14548ccf02d8c756d8" }, { "url": "https://git.kernel.org/stable/c/95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c" }, { "url": "https://git.kernel.org/stable/c/90089584b2e25c4510b7b987387b4405f0673ece" }, { "url": "https://git.kernel.org/stable/c/151b1799861fde38087c08f613abc2843ef597b0" }, { "url": "https://git.kernel.org/stable/c/d07b26f39246a82399661936dd0c853983cfade7" } ], "title": "ksmbd: require minimum ACE size in smb_check_perm_dacl()", "x_generator": { "engine": "bippy-1.2.0" } } } }