{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31707", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.132Z", "datePublished": "2026-05-01T13:56:05.219Z", "dateUpdated": "2026-08-05T12:24:42.073Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:42.073Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate response sizes in ipc_validate_msg()\n\nipc_validate_msg() computes the expected message size for each\nresponse type by adding (or multiplying) attacker-controlled fields\nfrom the daemon response to a fixed struct size in unsigned int\narithmetic. Three cases can overflow:\n\n KSMBD_EVENT_RPC_REQUEST:\n msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz;\n KSMBD_EVENT_SHARE_CONFIG_REQUEST:\n msg_sz = sizeof(struct ksmbd_share_config_response) +\n resp->payload_sz;\n KSMBD_EVENT_LOGIN_REQUEST_EXT:\n msg_sz = sizeof(struct ksmbd_login_response_ext) +\n resp->ngroups * sizeof(gid_t);\n\nresp->payload_sz is __u32 and resp->ngroups is __s32. Each addition\ncan wrap in unsigned int; the multiplication by sizeof(gid_t) mixes\nsigned and size_t, so a negative ngroups is converted to SIZE_MAX\nbefore the multiply. A wrapped value of msg_sz that happens to\nequal entry->msg_sz bypasses the size check on the next line, and\ndownstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz,\nkmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the\nunverified length.\n\nUse check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST\npaths to detect integer overflow without constraining functional\npayload size; userspace ksmbd-tools grows NDR responses in 4096-byte\nchunks for calls like NetShareEnumAll, so a hard transport cap is\nunworkable on the response side. For LOGIN_REQUEST_EXT, reject\nresp->ngroups outside the signed [0, NGROUPS_MAX] range up front and\nreport the error from ipc_validate_msg() so it fires at the IPC\nboundary; with that bound the subsequent multiplication and addition\nstay well below UINT_MAX. The now-redundant ngroups check and\npr_err in ksmbd_alloc_user() are removed.\n\nThis is the response-side analogue of aab98e2dbd64 (\"ksmbd: fix\ninteger overflows on 32 bit systems\"), which hardened the request\nside." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The malformed length fields enter the kernel through ksmbd generic-netlink IPC response messages, not directly from SMB network packets. SMB traffic can create the pending request, but the attacker must be local to inject or control the IPC response.\nAC:L - The attacker controls the response fields and can choose wrapped sizes that satisfy the old equality check. Any response race is practical because handles are small/predictable and the attacker can trigger repeated pending requests.\nPR:L - The IPC response handlers are gated by CAP_NET_ADMIN when the default check is enabled, but the generic-netlink family is netns-aware and CAP_NET_ADMIN is commonly reachable from an unprivileged user namespace. If that check is disabled, no capability is needed, so Low is the conservative privilege choice.\nUI:N - No victim user action is required once ksmbd is running. The attacker can trigger the SMB-side request and send the crafted IPC response directly.\nS:U - The vulnerability affects kernel memory and ksmbd state within the same host security authority. It does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - The wrapped RPC response size can make downstream code copy data beyond the validated response buffer, including into SMB responses. This can disclose kernel heap memory and is best scored as high confidentiality impact.\nI:N - The investigated consumers primarily perform oversized reads from the undersized IPC response or fail large allocations. I did not find a direct out-of-bounds write or control-flow overwrite primitive from this bug alone.\nA:H - The oversized copies and huge allocations can trigger kernel faults, memory exhaustion, or service failure. Repeated crafted responses can therefore produce high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/mgmt/user_config.c", "fs/smb/server/transport_ipc.c" ], "versions": [ { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "bf396208418371174869baba9434535cd3288e80", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "7dd0c858e1909769a4c91842724315ee74f1a5f1", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "299db777ea0cfa5c407e41b045c24a14c034c27b", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "99c631d0366c1eab8fb188fe66425f4581ebdde4", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "d6a6aa81eac2c9bff66dc6e191179cb69a14426b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/mgmt/user_config.c", "fs/smb/server/transport_ipc.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.84", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.25", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.2", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.141" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.84" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.25" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.0.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/bf396208418371174869baba9434535cd3288e80" }, { "url": "https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1" }, { "url": "https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b" }, { "url": "https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4" }, { "url": "https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b" } ], "title": "ksmbd: validate response sizes in ipc_validate_msg()", "x_generator": { "engine": "bippy-1.2.0" } } } }