Incorrect buffer length calculation in Linux kernel ksmbd SMB server (CVE-2026-31478)

The Linux kernel's ksmbd SMB server daemon contains an incorrect buffer length calculation in `smb2_calc_max_out_buf_len()`, where hardcoded magic numbers are used in place of the correct `offsetof()` value for the response structure's Buffer field following a change to dynamic iov array-based response buffer management. An attacker could possibly use this flaw to compromise the system. Affected versions: - Ubuntu 25.10 We recommend updating to: linux-image-6.17.0-1018-oracle 6.17.0-1018.18, linux-image-6.17.0-1018-oracle-64k 6.17.0-1018.18, linux-image-6.17.0-1019-aws 6.17.0-1019.19, linux-image-6.17.0-1019-aws-64k 6.17.0-1019.19, linux-image-6.17.0-1020-gcp 6.17.0-1020.22, linux-image-6.17.0-1020-gcp-64k 6.17.0-1020.22, linux-image-6.17.0-40-generic 6.17.0-40.40, linux-image-6.17.0-40-generic-64k 6.17.0-40.40. CVSS 9.8 · our assessment: act_now Reference: https://ubuntu.com/security/notices/USN-8490-1 Details: https://vuln.today/cve/CVE-2026-31478