PT-2026-34965 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-06 · CVE-2026-31613

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SMB client when parsing symlink error responses. When a CREATE request returns STATUS STOPPED ON SYMLINK, the smb2 check message() function returns success without length validation. The symlink data() function may read past the end of the buffer when processing SMB 3.1.1 error contexts if the server-controlled ErrorDataLength advances the pointer too close to the end. Additionally, smb2 parse symlink response() uses a fixed offset for the substitute name check, which is only accurate when ErrorContextCount is zero. If error contexts are present, the substitute name read can exceed the buffer length, causing out-of-bound heap bytes to be UTF-16-decoded and returned to userspace via readlink(2).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-31613

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 76

• https://osv.dev/vulnerability/BELL-CVE-2026-31613 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31613 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31613 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://git.kernel.org/stable/c/3df690bba28edec865cf7190be10708ad0ddd67e · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31613 · Vendor Advisory
• https://git.kernel.org/stable/c/781902e069f4ecb6c3b83502f181972c1446110a · Patch
• https://git.kernel.org/stable/c/e0dd90d14cbbf318157ea8e3fb62ee68a28655ed · Patch
• https://ubuntu.com/security/CVE-2026-31613 · Vendor Advisory
• https://git.kernel.org/stable/c/a66ef2e7ed837325c5600f8617d5ee0a0a149fdd · Patch
• https://cve.org/CVERecord?id=CVE-2026-31613 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31613 · Security Note
• https://suse.com/security/cve/CVE-2026-31577 · Note
• https://suse.com/security/cve/CVE-2026-31587 · Note
• https://suse.com/security/cve/CVE-2026-31578 · Note