PT-2026-36335 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-26 · CVE-2026-31705

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write exists in the smb2 get ea() function within the ksmbd module. The function applies 4-byte alignment padding using memset() after writing each Extended Attribute (EA) entry. While a bounds check on buf free len is performed before the value memcpy, the alignment memset occurs unconditionally without verifying the remaining space. If the EA value exactly fills the remaining buffer, the alignment process writes 1-3 NUL bytes beyond the buf free len boundary. In compound requests where a response buffer is shared across commands, this can lead to overwriting adjacent kernel heap memory beyond the physical kvmalloc allocation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-31705

ECHO-6A15-D8AF-61AC

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 54

• https://osv.dev/vulnerability/BELL-CVE-2026-31705 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31705 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31705 · Vendor Advisory
• https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31705 · Vendor Advisory
• https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31705 · Vendor Advisory
• https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31705 · Security Note
• https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f · Patch
• https://ubuntu.com/security/CVE-2026-31705 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31705 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-31705 · Note