PT-2026-34963 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-26 · CVE-2026-31611

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the ksmbd module, the parse dacl() function compares each Access Control Entry (ACE) Security Identifier (SID) against sid unix NFS mode. If sid unix NFS mode is the prefix S-1-5-88-3 with num subauth equal to 2, a client SID with num subauth equal to 2 and sub auth equal to {88, 3} will match. If the ACE is located at the end of the security descriptor, the system reads sub auth[2], which is 4 bytes beyond the end of the Access Control List (ACL). These out-of-band bytes are then masked to the low 9 bits and applied as the file's POSIX mode.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31611

ECHO-A4CC-4540-6BD4

OESA-2026-2416

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 110

• https://security-tracker.debian.org/tracker/CVE-2026-31611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31447 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23273 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43048 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31611 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31611 · Vendor Advisory
• https://git.kernel.org/stable/c/08f9e6d899b5c834bbcc239eae1bed58d9b15d2c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31393 · Security Note
• https://git.kernel.org/stable/c/53370cf9090777774e07fd9a8ebce67c6cc333ab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-39841 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31704 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68185 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31477 · Security Note