PT-2026-36337 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-16 · CVE-2026-31707

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow exists in the ipc validate msg() function within the ksmbd module. The function calculates the expected message size for response types by performing unsigned integer arithmetic on attacker-controlled fields from the daemon response. Specifically, overflows can occur in the following cases:

• KSMBD EVENT RPC REQUEST where msg sz is calculated using resp->payload sz.
• KSMBD EVENT SHARE CONFIG REQUEST where msg sz is calculated using resp->payload sz.
• KSMBD EVENT LOGIN REQUEST EXT where msg sz is calculated using resp->ngroups.

If the calculated msg sz wraps around and matches the expected size, it bypasses size checks. This allows downstream consumers to trust unverified lengths during memory operations, such as memcpy in smb2pdu.c or kmemdup in ksmbd alloc user().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-31707

ECHO-3008-061F-F070

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 49

• https://security-tracker.debian.org/tracker/CVE-2026-31707 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31707 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-31707 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31707 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31707 · Vendor Advisory
• https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b · Patch
• https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31707 · Vendor Advisory
• https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b · Patch
• https://ubuntu.com/security/CVE-2026-31707 · Vendor Advisory
• https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1 · Patch
• https://suse.com/security/cve/CVE-2026-31713 · Note
• https://suse.com/security/cve/CVE-2026-31712 · Note
• https://suse.com/security/cve/CVE-2026-43500 · Note