PT-2026-36336 · Linux · Linux Kernel

Namjae · Published 2026-05-01 · Updated 2026-05-16 · CVE-2026-31706

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where the smb inherit dacl() function trusts the num aces value from a parent directory's DACL xattr to determine the size of a heap allocation. An authenticated client can tamper with the security.NTACL of a parent directory to provide a large num aces value (e.g., 65535) with minimal actual ACE data. This can lead to an uninitialized ~8 MB allocation and may cause a size t multiplication overflow on 32-bit kernels. Additionally, the ACE walk loop fails to properly reject ACEs whose declared size is below the minimum valid on-wire ACE size. The issue was triggered during an SMB2 CREATE operation via the smb2 open() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31706

ECHO-C46A-217A-9030

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 49

• https://git.kernel.org/stable/c/063a7409b0de46d7c770b65bb0338e6fdb3b1f0a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31706 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31706 · Vendor Advisory
• https://git.kernel.org/stable/c/59c32abaaec9cdd6164811c7e864e72f7554b82d · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31706 · Vendor Advisory
• https://git.kernel.org/stable/c/3e4e2ea2a781018ed5d75f969e3e5606beb66e48 · Patch
• https://git.kernel.org/stable/c/3e5360b422dd741cb315654a191fa73869a37414 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31706 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31706 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31706 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31706 · Security Note
• https://suse.com/security/cve/CVE-2026-31713 · Note
• https://suse.com/security/cve/CVE-2026-31712 · Note
• https://suse.com/security/cve/CVE-2026-43500 · Note