CVE-2026-31432

Last refreshed2026-10-30

Status: UPDATED | Advisory ID: CVE-2026-31432

Key Details

CVE	CVE-2026-31432
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-30
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-787 (Out-of-bounds Write)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix OOB write in QUERY_INFO for compound requests

When a compound request such as READ + QUERY_INFO(Security) is received,

and the first command (READ) consumes most of the response buffer,

ksmbd could write beyond the allocated buffer while building a security

descriptor.

The root cause was that smb2_get_info_sec() checked buffer space using

ppntsd_size from xattr, while build_sec_desc() often synthesized a

significantly larger descriptor from POSIX ACLs.

This patch introduces smb_acl_sec_desc_scratch_len() to accurately

compute the final descriptor size beforehand, performs proper buffer

checking with smb2_calc_max_out_buf_len(), and uses exact-sized

allocation + iov pinning. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-31432
CVE	https://www.cve.org/CVERecord?id=CVE-2026-31432

Source

Reference

NVD

CVE