CVE-2026-31432 ksmbd: fix OOB write in QUERY_INFO for compound requests
A remote attacker can trigger an out-of-bounds write in the Linux kernel's ksmbd SMB server via compound requests, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31432?
CVE-2026-31432 is a high-severity memory corruption vulnerability in Linux kernel, published on 22 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix OOB write in QUERY_INFO for compound requests
When a compound request such as READ + QUERY_INFO(Security) is received, and the first command (READ) consumes most of the response buffer, ksmbd could write beyond the allocated buffer while building a security descriptor.
The root cause was that smb2_get_info_sec() checked buffer space using ppntsd_size from xattr, while build_sec_desc() often synthesized a significantly larger descriptor from POSIX ACLs.
This patch introduces smb_acl_sec_desc_scratch_len() to accurately compute the final descriptor size beforehand, performs proper buffer checking with smb2_calc_max_out_buf_len(), and uses exact-sized allocation + iov pinning.
Weakness: CWE-787
Which versions are affected by CVE-2026-31432?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31432?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31432 being exploited?
There is no known exploitation of CVE-2026-31432 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31432, DEBIAN-CVE-2026-31432, GHSA-f75p-6q8j-p2f2, ROOT-OS-DEBIAN-12-CVE-2026-31432, ROOT-OS-UBUNTU-2204-CVE-2026-31432, ROOT-OS-UBUNTU-2404-CVE-2026-31432 and 1 more.