CVE-2026-31611 ksmbd: require 3 sub-authorities before reading sub_auth[2]
A missing bounds check in the Linux kernel ksmbd module allows out-of-bounds memory reads when parsing specific SIDs, potentially leaking data or causing crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31611?
CVE-2026-31611 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: require 3 sub-authorities before reading sub_auth[2]
parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is the prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares only min(num_subauth, 2) sub-authorities so a client SID with num_subauth = 2 and sub_auth = {88, 3} will match.
If num_subauth = 2 and the ACE is placed at the very end of the security descriptor, sub_auth[2] will be 4 bytes past end_of_acl. The out-of-band bytes will then be masked to the low 9 bits and applied as the file's POSIX mode, probably not something that is good to have happen.
Fix this up by forcing the SID to actually carry a third sub-authority before reading it at all.
Which versions are affected by CVE-2026-31611?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31611?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31611 being exploited?
There is no known exploitation of CVE-2026-31611 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83753, BELL-CVE-2026-31611, DEBIAN-CVE-2026-31611, GHSA-5q38-6rwh-6r7q, ROOT-OS-DEBIAN-12-CVE-2026-31611, ROOT-OS-UBUNTU-2204-CVE-2026-31611 and 2 more.