Skip to main content

Linux Kernel CVE-2026-31704

| EUVDEUVD-2026-26513 MEDIUM
2026-05-01 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only attack via ksmbd requiring a low-privileged account; no remote vector; impact is availability loss from buffer corruption, with no confirmed confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 01:14 vuln.today
CVSS changed
May 06, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch released
May 01, 2026 - 15:24 nvd
Patch available
Patch available
May 01, 2026 - 15:02 EUVD
EUVD ID Assigned
May 01, 2026 - 14:22 euvd
EUVD-2026-26513
CVE Published
May 01, 2026 - 14:16 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use check_add_overflow() to prevent u16 DACL size overflow

set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causing the pointer arithmetic (char *)pndace + *size to land within already-written ACEs. Subsequent writes then overwrite earlier entries, and pndacl->size gets a truncated value.

Use check_add_overflow() at each accumulation point to detect the wrap before it corrupts the buffer, consistent with existing check_mul_overflow() usage elsewhere in smbacl.c.

AnalysisAI

Integer overflow in the ksmbd SMB server component of the Linux kernel allows a local low-privileged user to corrupt DACL buffer memory by creating files with a high number of POSIX ACL entries. The functions set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables; when those totals exceed 65535, pointer arithmetic redirects subsequent writes into already-written ACE data, producing a malformed DACL with a truncated size field and potential kernel memory corruption within the ksmbd subsystem. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (5th percentile) confirms minimal exploitation interest, consistent with the local-only attack vector.

Technical ContextAI

ksmbd is the in-kernel SMB3 server first introduced in Linux 5.15, implemented in fs/smb/server/. The vulnerability sits in smbacl.c, specifically in set_posix_acl_entries_dacl() and set_ntacl_dacl(), which build a Windows-style DACL (Discretionary Access Control List) by iterating over POSIX ACL entries and appending ACE (Access Control Entry) structures sequentially into a buffer. Both functions track the running total of ACE sizes using u16 variables - a 16-bit unsigned type capped at 65535. When a file carries enough POSIX ACL entries that their combined sizes surpass that cap, the accumulator wraps silently (a classic CWE-190 integer overflow / CWE-122 heap-based buffer overwrite scenario, though CWE is listed as N/A in NVD). After wrap, the expression (char *)pndace + *size resolves to an address inside already-written ACE data, so subsequent ACE copies overwrite earlier entries. The fix applies check_add_overflow() at each accumulation site to detect overflow before it corrupts the buffer, mirroring the existing use of check_mul_overflow() elsewhere in smbacl.c. The affected CPE is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* covering multiple stable branches.

RemediationAI

Update the Linux kernel to one of the following patched versions, selecting the branch that matches your current stable series: 6.6.136, 6.12.84, 6.18.25, or 7.0.2 (stable), or 7.1-rc1 (mainline). The corresponding upstream fix commits are available at https://git.kernel.org/stable/c/299f962c0b02d048fb45d248b4da493d03f3175d, https://git.kernel.org/stable/c/5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43, https://git.kernel.org/stable/c/8d5729350b236896f51379588d9a690b7fafb8db, https://git.kernel.org/stable/c/e1955a94b6f17f4b058afa955a6f187eb3ed7615, and https://git.kernel.org/stable/c/ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7. Ubuntu users should apply packages referenced in USN-8488-1 at https://ubuntu.com/security/notices/USN-8488-1. Where patching is not immediately possible, unloading the ksmbd kernel module via 'modprobe -r ksmbd' eliminates the entire attack surface with the trade-off of terminating all SMB services provided by ksmbd; Samba can serve as a functional replacement during the maintenance window. A narrower workaround is to enforce POSIX ACL entry limits per user via filesystem quotas or ACL policies, though determining the exact entry threshold that triggers overflow requires per-ACE-size analysis and is not a reliable long-term control. A patched version for the Linux 5.15 longterm branch is not independently confirmed from available data - users on 5.15 should verify with their distribution vendor.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31704 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy