PT-2026-36339 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-28 · CVE-2026-31709

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SMB client where the system fails to fully validate the Discretionary Access Control List (DACL) before rewriting it in cifsacl. The functions build sec desc() and id mode to cifs acl() derive a DACL pointer from a server-supplied dacloffset to rebuild security descriptors for chmod/chown operations. While header fields are checked, the system does not perform structural validation of the DACL body. A malicious server can provide a truncated DACL that claims to contain one or more Access Control Entries (ACEs), causing replace sids and copy aces() or set chmod dacl() to read past the validated memory extent while processing attacker-controlled ACEs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ALSA-2026:21706

ALSA-2026:21745

CVE-2026-31709

ECHO-9671-B50A-2F9F

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 91

• https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8 · Patch
• https://osv.dev/vulnerability/ALSA-2026:21706 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31709 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-21706.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31709 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31709 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31709 · Vendor Advisory
• https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a · Patch
• https://errata.almalinux.org/8/ALSA-2026-21745.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31709 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:21745 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31709 · Security Note
• https://bugzilla.redhat.com/2464462 · Note