PT-2026-36342 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-26 · CVE-2026-31712

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the ksmbd component. The smb check perm dacl() function fails to properly validate that an Access Control Entry (ACE) size is sufficient for the structure it describes. An authenticated SMB client with permissions to set an ACL on a file can create a crafted Discretionary Access Control List (DACL) where the ace->size is smaller than required. When the kernel subsequently processes a CREATE request for that file, it triggers an out-of-bounds read while accessing the access req and ace->sid variables. This can lead to kernel state corruption or be detected by KASAN (Kernel Address Sanitizer), a dynamic memory error detector.

Recommendations As a temporary workaround, restrict the ability of users to set custom ACLs on files accessed via SMB until a patch is applied.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-31712

ECHO-2826-63DF-7583

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 52

• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31712 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31712 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31712 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31712 · Security Note
• https://git.kernel.org/stable/c/d07b26f39246a82399661936dd0c853983cfade7 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31712 · Vendor Advisory
• https://git.kernel.org/stable/c/151b1799861fde38087c08f613abc2843ef597b0 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31712 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31712 · Vendor Advisory
• https://git.kernel.org/stable/c/90089584b2e25c4510b7b987387b4405f0673ece · Patch
• https://git.kernel.org/stable/c/95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31712 · Vendor Advisory
• https://git.kernel.org/linus/d07b26f39246a82399661936dd0c853983cfade7 · Note
• https://suse.com/security/cve/CVE-2026-31709 · Note