Skip to main content

Linux Kernel EUVDEUVD-2026-26518

| CVE-2026-31709 HIGH
Improper Validation of Consistency within Input (CWE-1288)
2026-05-01 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    User mounts attacker SMB share
  2. Delivery
    Malicious server sends truncated DACL
  3. Exploit
    User triggers chmod/chown operation
  4. Execution
    Kernel ACE parser reads OOB memory
  5. Persist
    Information disclosure or memory corruption
  6. Impact
    Potential privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-1288
ASVS 5.0
V15 - Secure Coding and Architecture Hardware validation bypass
Exploitation Conditions

Requires active user interaction to mount or access an SMB share hosted on an attacker-controlled server. The SMB client must perform a chmod or chown operation that triggers the vulnerable DACL rewrite code paths in build_sec_desc() or id_mode_to_cifs_acl(). The Linux kernel must be compiled with CONFIG_CIFS=y or CONFIG_CIFS=m with the cifs module loaded. Exploitation is limited to scenarios where users connect SMB clients to untrusted servers (external shares, compromised internal servers, MITM-attacked connections). Default enterprise configurations connecting only to authenticated internal AD-joined SMB servers reduce attack surface significantly. User must have permissions to initiate SMB mount operations (typically requires root or CAP_SYS_ADMIN, though user-space mount helpers may lower this barrier). The vulnerability does NOT affect SMB servers running on Linux, only the client-side CIFS implementation.
Impact

Real-world risk assessment reveals moderate practical concern despite high CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible attack with low complexity but critically requires user interaction - a user must actively mount or access a malicious SMB share. The S:U (unchanged scope) suggests impact limited to the SMB client component rather than broader kernel compromise. EPSS score of 0.02% (5th percentile) indicates security researchers and attackers have not prioritized this vulnerability, likely because exploitation requires a man-in-the-middle position or user connecting to attacker-controlled SMB server. No CISA KEV listing confirms no observed active exploitation in enterprise environments. The vulnerability enables memory disclosure and potential code execution within kernel context (C:H/I:H/A:H), but practical exploitation requires combining the malicious SMB server with social engineering to convince users to connect. Organizations using SMB mounts to untrusted servers face higher risk; those connecting only to internal authenticated SMB shares have natural mitigations through network segmentation. Priority should be moderate - patch during normal cycles unless environment involves routine SMB connections to untrusted external servers.
Exploit ScenarioDerived

An attacker operates a malicious SMB server on the internet or positions themselves as man-in-the-middle on network path. A Linux user attempts to mount an SMB share (via mount.cifs, smbclient, or file manager SMB browsing) to the attacker-controlled server. The malicious server responds to DACL queries with a crafted SMB response containing a truncated DACL structure: a valid smb_acl header claiming multiple ACEs but providing insufficient data. When the kernel's build_sec_desc() or id_mode_to_cifs_acl() processes a subsequent chmod/chown operation, replace_sids_and_copy_aces() iterates beyond validated memory bounds reading attacker-influenced data, potentially leaking kernel memory or triggering exploitable memory corruption for privilege escalation to root.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 03, 2026

Remote unauthenticated attackers can trigger out-of-bounds memory access in the Linux kernel SMB client's DACL parsing code by sending a malicious SMB response with a truncated DACL structure. The vulnerability exists in build_sec_desc() and id_mode_to_cifs_acl() functions which insufficiently validate server-supplied ACL data before rewriting it during chmod/chown operations, allowing ACE traversal beyond validated memory bounds. CVSS 8.8 indicates high severity with network vector requiring user interaction. EPSS score of 0.02% (5th percentile) suggests low observed exploitation probability in the wild, and no active exploitation is confirmed (not in CISA KEV). Vendor patch available targeting Linux kernel 7.0.2 and 7.1-rc1.

RemediationAI

Upgrade to Linux kernel version 7.0.2 or later, or apply the vendor-supplied patches from stable kernel tree (commits 0a8cf165566ba55a39fd0f4de172119dd646d39a or b78db9bddc84136f6a0bb49e8883cf200dfb87a8). Distribution users should apply security updates from their vendor (Red Hat RHSA, Ubuntu USN, Debian DSA, SUSE updates) that backport the validate_dacl() fix to their kernel branches. For systems unable to patch immediately, implement network-level controls restricting SMB client connections to only trusted authenticated internal servers via firewall rules blocking outbound TCP 445/139 to untrusted networks. Alternatively, disable CIFS kernel module (rmmod cifs; echo 'blacklist cifs' >> /etc/modprobe.d/blacklist.conf) if SMB client functionality is not required, though this breaks legitimate SMB mount operations. Organizations can also restrict user privileges to mount filesystems via fstab policies and mount namespace restrictions, preventing unprivileged users from connecting to arbitrary SMB servers, though administrative users retain the capability. Each workaround trades SMB client functionality for reduced attack surface.

Affected VersionsENISA

Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <b78db9bddc84136f6a0bb49e8883cf200dfb87a8
Linux patch: 0
Linux 5.12
Linux patch: 7.1-rc1
Linux patch: 7.0.2
Linux bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <0a8cf165566ba55a39fd0f4de172119dd646d39a

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects the Linux kernel CIFS (Common Internet File System) client implementation, specifically the ACL (Access Control List) handling in cifsacl code. When the SMB client processes DACL (Discretionary Access Control List) structures from SMB servers during security descriptor operations, the parsing functions build_sec_desc() and id_mode_to_cifs_acl() extract a DACL pointer from a server-supplied dacloffset field. The original code validated only the smb_acl header structure but failed to validate the complete DACL body before functions like replace_sids_and_copy_aces() or set_chmod_dacl() iterate through ACEs (Access Control Entries) based on the num_aces field. This creates a classic TOCTOU (time-of-check-time-of-use) gap where header validation occurs but subsequent ACE traversal operations assume well-formed data. The fix introduces a centralized validate_dacl() function that performs complete structural validation of both DACL headers and individual ACE boundaries, ensuring parse_dacl() and the chmod/chown rewrite paths use consistent validation logic.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.1 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 03, 2026 - 07:22 NVD
8.8 (HIGH)
Patch released
May 03, 2026 - 07:16 nvd
Patch available
Patch available
May 01, 2026 - 15:02 EUVD
CVE Published
May 01, 2026 - 14:16 nvd
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: validate the whole DACL before rewriting it in cifsacl

build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor.

The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL body.

A malicious server can return a truncated DACL that still contains a header, claims one or more ACEs, and then drive replace_sids_and_copy_aces() or set_chmod_dacl() past the validated extent while they compare or copy attacker-controlled ACEs.

Factor the DACL structural checks into validate_dacl(), extend them to validate each ACE against the DACL bounds, and use the shared validator before the chmod/chown rebuild paths. parse_dacl() reuses the same validator so the read-side parser and write-side rewrite paths agree on what constitutes a well-formed incoming DACL.

Executive ViewAI

Why It Matters

CVE-2026-31709 is a high-severity remote memory corruption vulnerability in the Linux kernel SMB client that allows unauthenticated attackers to crash systems or potentially execute code by sending malicious SMB responses during file permission operations. Organizations using Linux systems with SMB/CIFS network shares face potential service disruption and data access failures, requiring kernel patching on affected systems.

Business Impact: High
Compensating Controls

Apply vendor patch. Interim mitigation: disable SMB/CIFS client functionality via kernel module blacklist (echo 'blacklist cifs' >> /etc/modprobe.d/blacklist.conf) on systems where SMB access is not required; restrict SMB network access at firewall boundaries (TCP 445) to trusted servers only; implement network segmentation to limit SMB traffic exposure.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
1
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

54
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-1288 – Improper Validation of Consistency within Input

View all
CVE-2026-18794 HIGH
8.8
CVE-2026-101951 HIGH
8.7
CVE-2026-56744 HIGH
8.7
CVE-2024-39515 HIGH
8.7
CVE-2026-94200 HIGH
8.2
CVE-2026-9689 MEDIUM POC
4.2
CVE-2024-25951 HIGH
8.0
CVE-2026-42982 HIGH
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://vuldb.com/vuln/360600 REF https://access.redhat.com/errata/RHSA-2026:21556 REF https://access.redhat.com/errata/RHSA-2026:21706 REF https://access.redhat.com/errata/RHSA-2026:21745 REF https://access.redhat.com/errata/RHSA-2026:22900 REF https://access.redhat.com/errata/RHSA-2026:22940 REF https://access.redhat.com/errata/RHSA-2026:23224 REF https://access.redhat.com/errata/RHSA-2026:23237 REF https://access.redhat.com/errata/RHSA-2026:23329 REF https://access.redhat.com/errata/RHSA-2026:24343 REF https://access.redhat.com/security/cve/CVE-2026-31709 REF https://bugzilla.redhat.com/show_bug.cgi?id=2464476 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a REF https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 REF https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8 REF https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d REF https://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391 REF https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3 REF https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy