PT-2026-36338 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-16 · CVE-2026-31708

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the smb2 ioctl query info() function within the QUERY INFO path. The function clamps qi.input buffer length to the server-reported OutputBufferLength and copies that amount of data from qi rsp->Buffer to userspace without verifying if the flexible-array payload fits within rsp iov[1].iov len. A malicious server can provide an OutputBufferLength larger than the actual response, causing copy to user() to read past the response buffer and expose adjacent kernel heap memory to userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-31708

ECHO-1CF4-8DED-3323

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 50

• https://ubuntu.com/security/CVE-2026-31708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31708 · Security Note
• https://git.kernel.org/stable/c/078fae8f50adebb903ccf2252b44391324571e78 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31708 · Vendor Advisory
• https://git.kernel.org/stable/c/85fd46ee26a11841c670449508025965f61ce131 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31708 · Vendor Advisory
• https://git.kernel.org/stable/c/ac2f14e4705d020f04e806efa0d49ab8dc2b145f · Patch
• https://git.kernel.org/stable/c/a34d456934fe42e4da5d2cc07787bf418bee99c6 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31708 · Security Note
• https://git.kernel.org/stable/c/a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31708 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31708 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-31713 · Note
• https://suse.com/security/cve/CVE-2026-31712 · Note