Linux ksmbd CVE-2026-31706

Requires authenticated SMB access (PR:L) to a ksmbd-served share explicitly configured with 'vfs objects = acl_xattr' in smb.conf-not enabled by default. Attacker must also possess the ability to modify extended attributes on the backing filesystem, achieved through either: (a) concurrent local filesystem access (e.g., shell account on the same server, container escape, or compromised backup process with filesystem write permissions), or (b) exploitation of a separate race condition in ksmbd's xattr write path allowing SMB-initiated xattr corruption. The vulnerable code path is only reachable during SMB2 CREATE operations targeting child objects under a directory with a corrupted NTACL xattr, and only when the parent directory's posix_acl_hash matches expected values (to pass ksmbd_vfs_get_sd_xattr() validation). Exploitation is limited to systems running Linux kernel 5.15+ with ksmbd module loaded and configured. Not exploitable against default ksmbd configurations lacking ACL xattr support, nor against systems using only userspace Samba. The information disclosure component (uninitialized heap read) is achievable with just the above conditions; code execution requires additional heap manipulation techniques specific to kernel heap allocator state.

Real-world risk is moderate and highly context-dependent. CVSS 8.8 (High) reflects worst-case impact-network-accessible, low-complexity exploitation yielding high confidentiality/integrity/availability impact-but this assumes the attacker can modify backing filesystem xattrs, which is NOT a default capability for SMB clients. The CVSS vector AV:N/AC:L/PR:L indicates network vector with low complexity and low privileges, yet the description reveals critical prerequisites: the attacker needs either offline filesystem access to corrupt xattrs OR a race condition in ksmbd's xattr handling paths. EPSS 5th percentile (0.02%) confirms no observed widespread exploitation, consistent with the non-trivial attack prerequisites. SSVC assessment: Exploitation status is 'proof-of-concept' per the changelog's UML+KASAN reproduction; automatable is 'no' due to filesystem access requirement; technical impact is 'total' (potential code execution). Priority depends on deployment: high-risk for multi-tenant environments where ksmbd serves untrusted users who may also have local filesystem access; low-risk for isolated file servers with readonly backing stores. The uninitialized heap allocation creates real information disclosure risk even without achieving code execution. Patches available across all supported stable branches significantly reduce urgency-this is a 'patch now during normal maintenance' rather than 'emergency response' scenario for most deployments.

An attacker with valid low-privilege SMB credentials authenticates to a ksmbd-served file share configured with Windows ACL inheritance (vfs objects = acl_xattr). They create a parent directory via legitimate SMB2 CREATE request, causing ksmbd to write a valid security.NTACL xattr to the backing ext4/xfs filesystem. The attacker then leverages either (1) a secondary shell account on the same server, or (2) a race condition in ksmbd's xattr handling to directly modify the security.NTACL xattr on the backing filesystem, setting num_aces to 0xFFFF while preserving the posix_acl_hash to bypass integrity checks. When the attacker subsequently creates a child file/directory under that parent via SMB2 CREATE, ksmbd's smb_inherit_dacl() reads the corrupted num_aces value, allocates an 8 MB uninitialized heap buffer, populates only a small portion based on actual ACE data present, then continues processing. The attacker can potentially read uninitialized kernel heap contents via SMB responses (information disclosure) or, with additional exploitation primitives, leverage the allocation size mismatch for memory corruption leading to code execution.