Linux kernel ksmbd CVE-2026-31432

Requires authenticated SMB access with low-privilege credentials (CVSS PR:L) to a Linux system running the ksmbd kernel module (not Samba). Target system must have ksmbd enabled and accessible over the network (CVSS AV:N). Exploitation depends on specific deployment conditions: ksmbd must be actively serving SMB shares, target files must have POSIX ACLs configured (triggering security descriptor synthesis in build_sec_desc), and the attacker must craft compound requests with precise buffer consumption in the first command to trigger the overflow in the second QUERY_INFO operation. The vulnerability does not affect default Linux installations using Samba for SMB services, significantly limiting real-world exposure. Ksmbd adoption is primarily in specialized environments like containerized storage solutions or embedded Linux NAS devices. No user interaction required (CVSS UI:N) once network access and authentication are achieved.

CVSS 8.8 (High) reflects the technical severity: network-accessible, low complexity attack requiring only low-privilege authenticated access with potential for complete system compromise (C:H/I:H/A:H). However, real-world risk is substantially lower based on multiple factors. EPSS 0.01% (1st percentile) indicates minimal observed exploitation activity. The vulnerability requires authenticated SMB access to a ksmbd-enabled Linux system, which is a relatively narrow attack surface since most production SMB deployments use Samba rather than the newer ksmbd implementation. The attack vector requires precise timing of compound requests where the first command consumes specific buffer amounts, adding exploitation complexity beyond the CVSS AC:L rating. No CISA KEV listing, no public POC, and availability of vendor patches across multiple kernel branches further reduce urgency. Priority should be moderate for organizations running ksmbd in production (apply patches during normal maintenance windows), but low for environments using Samba or not exposing SMB services. The CVSS score alone would suggest critical priority, but exploitation conditions, limited ksmbd adoption, low EPSS, and patch availability indicate this is manageable through standard patching cycles rather than emergency response.

An attacker with valid low-privilege SMB credentials connects to a Linux server running ksmbd. They craft a compound SMB2 request containing a READ operation designed to consume most of the allocated response buffer, immediately followed by a QUERY_INFO request for security descriptor information on a file with complex POSIX ACLs. When ksmbd processes the QUERY_INFO, it underestimates the size needed to synthesize a Windows security descriptor from the ACLs, writing beyond the allocated buffer boundary. This out-of-bounds write corrupts adjacent kernel memory structures, potentially allowing the attacker to execute arbitrary code in kernel context or crash the system.