Skip to main content

Linux Kernel CVE-2026-31710

| EUVDEUVD-2026-26519 MEDIUM
2026-05-01 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to trigger the mount-path ordering bug; only availability is impacted via path corruption on SMB1 UNIX mounts, with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 24, 2026 - 01:13 vuln.today
CVSS changed
May 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
EUVD ID Assigned
May 01, 2026 - 14:22 euvd
EUVD-2026-26519
CVE Published
May 01, 2026 - 14:16 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix dir separator in SMB1 UNIX mounts

When calling cifs_mount_get_tcon() with SMB1 UNIX mounts, @cifs_sb->mnt_cifs_flags needs to be read or updated only after calling reset_cifs_unix_caps(), otherwise it might end up with missing CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits.

This fixes the wrong dir separator used in paths caused by the missing CIFS_MOUNT_POSIX_PATHS bit in cifs_sb_info::mnt_cifs_flags.

AnalysisAI

Wrong directory separator usage in the Linux kernel SMB client (CIFS) subsystem corrupts path handling on SMB1 UNIX mounts, causing mounted shares to become unavailable. The bug in cifs_mount_get_tcon() reads cifs_sb->mnt_cifs_flags before reset_cifs_unix_caps() initializes it, leaving CIFS_MOUNT_POSIX_PATHS and CIFS_MOUNT_POSIXACL bits unset and triggering a high-availability impact (CVSS A:H) for affected mounts. No public exploit exists and EPSS is 0.02% (5th percentile), reflecting the niche SMB1 UNIX mount prerequisite and local-only attack surface.

Technical ContextAI

The vulnerability resides in the Linux kernel CIFS/SMB client implementation, specifically in the cifs_mount_get_tcon() function within the SMB1 UNIX mount code path (CPE: cpe:2.3:o:linux:linux_kernel:*). The root cause is an initialization ordering defect - not a memory safety or input validation flaw - where cifs_sb_info::mnt_cifs_flags is accessed before reset_cifs_unix_caps() has had a chance to populate it with the CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits. The absence of CIFS_MOUNT_POSIX_PATHS causes the CIFS driver to substitute the Windows-style backslash path separator instead of the POSIX forward slash, corrupting all path construction for that mount. No CWE was assigned; the closest class would be CWE-362 (improper synchronization / race condition on initialization) or CWE-665 (improper initialization), but neither is formally confirmed by NVD for this entry.

RemediationAI

Upgrade the Linux kernel to version 7.0.2 or 7.1-rc1, which incorporate the fixes at stable commits c4d3fc5844d685441befd0caaab648321013cdfd (https://git.kernel.org/stable/c/c4d3fc5844d685441befd0caaab648321013cdfd) and fbbfcf35e1ee3396631f3dc6214cb626aa9814c3 (https://git.kernel.org/stable/c/fbbfcf35e1ee3396631f3dc6214cb626aa9814c3). Ubuntu users should apply the kernel update from USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1); Red Hat and SUSE users should check their respective security portals for distribution-specific kernel packages. As a compensating control, avoid configuring SMB1 UNIX mounts entirely and migrate to SMBv2 or SMBv3, which eliminates exposure to this vulnerability and the broader class of SMBv1 security risks. Disabling the cifs kernel module's SMBv1 negotiation (via vers=3.0 or vers=2.1 mount options) prevents the affected code path from being reached, though this may affect legacy NAS interoperability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31710 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy