Skip to main content

Linux Kernel (ksmbd) CVE-2026-31478

| EUVDEUVD-2026-24835 CRITICAL
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-hjcf-h98x-x745
Information Disclosure Linux
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.1 HIGH

Network SMB path with low complexity, but reaching compound reads needs an authenticated session (PR:L); impact is primarily kernel memory disclosure (C:H) with possible crash (A:L), not integrity.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 05:19 vuln.today
Patch released
Apr 27, 2026 - 23:23 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24835
CVE Published
Apr 22, 2026 - 14:16 nvd
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()

After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value.

AnalysisAI

Information disclosure and memory corruption in the Linux kernel's in-kernel SMB3 server (ksmbd) arises from smb2_calc_max_out_buf_len() being called with a hardcoded header length instead of the true offsetof() of the response ->Buffer field, after the read-compound rework in commit e2b76ab8b5c9. On affected kernels running ksmbd (6.6 through 7.0-rc3, plus stable backports), a miscalculated maximum output buffer length can cause the server to over-read into the response IOV, leaking adjacent kernel memory to an SMB client or corrupting response buffers. No public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), consistent with a niche, non-default kernel subsystem rather than mass exploitation.

Technical ContextAI

ksmbd is the Linux kernel's native SMB/CIFS file server, an alternative to userspace Samba that handles SMB2/SMB3 protocol processing directly in kernel space. Commit e2b76ab8b5c9 ('ksmbd: add support for read compound') switched response buffer management to a dynamic iov array design in which smb2_calc_max_out_buf_len() expects its second argument (hdr2_len) to be the byte offset of the ->Buffer field within the specific SMB2 response structure. Several remaining call sites still passed a hardcoded magic number instead of the correct offsetof() value, so the computed maximum output length no longer matches the real header layout. Because this governs how much data is written into or read from the response buffer during compound read handling, the mismatch is a length-miscalculation bug of the CWE-125 (out-of-bounds read) / CWE-131 (incorrect buffer size calculation) family, even though NVD lists CWE as N/A. The Information Disclosure tag reflects that the practical consequence is leaking kernel memory back to the requesting SMB client.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or mainline 7.0 (or your distribution's equivalent), applying the backported commits referenced at git.kernel.org/stable. Distribution users should track and install the corresponding updates: Ubuntu via USN-8490-1 (https://ubuntu.com/security/notices/USN-8490-1) and the Red Hat/SUSE errata for their streams. Where immediate patching is not possible, the most effective compensating control is to stop exposing ksmbd: unload or disable the ksmbd kernel module and stop ksmbd.service if the host is not intentionally acting as an SMB server (side effect: SMB file sharing via ksmbd stops - migrate to userspace Samba if sharing is required), or firewall TCP 445 to restrict SMB access to trusted management networks only (side effect: blocks all SMB clients, not just malicious ones). If ksmbd must remain online, limit share access to authenticated, trusted principals and monitor for anomalous compound-read traffic. Do not rely on generic hardening alone - removing the ksmbd attack surface is the concrete mitigation here.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31478 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy