# CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response

> A malicious SMB server can trigger out-of-bounds reads in the Linux kernel SMB client, leaking heap memory to userspace via readlink.

- **Severity:** High 8.1 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 24 Apr 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-83774, BELL-CVE-2026-31613, DEBIAN-CVE-2026-31613, GHSA-3w37-m4pg-q585, ROOT-OS-DEBIAN-12-CVE-2026-31613, ROOT-OS-DEBIAN-13-CVE-2026-31613, ROOT-OS-UBUNTU-2204-CVE-2026-31613, ROOT-OS-UBUNTU-2404-CVE-2026-31613, UBUNTU-CVE-2026-31613

## What is CVE-2026-31613?

CVE-2026-31613 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB reads parsing symlink error response

When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message()
returns success without any length validation, leaving the symlink
parsers as the only defense against an untrusted server.

symlink_data() walks SMB 3.1.1 error contexts with the loop test "p <
end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset
0.  When the server-controlled ErrorDataLength advances p to within 1-7
bytes of end, the next iteration will read past it.  When the matching
context is found, sym->SymLinkErrorTag is read at offset 4 from
p->ErrorContextData with no check that the symlink header itself fits.

smb2_parse_symlink_response() then bounds-checks the substitute name
using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from
iov_base.  That value is computed as sizeof(smb2_err_rsp) +
sizeof(smb2_symlink_err_rsp), which is correct only when
ErrorContextCount == 0.

With at least one error context the symlink data sits 8 bytes deeper,
and each skipped non-matching context shifts it further by 8 +
ALIGN(ErrorDataLength, 8).  The check is too short, allowing the
substitute name read to run past iov_len.  The out-of-bound heap bytes
are UTF-16-decoded into the symlink target and returned to userspace via
readlink(2).

Fix this all up by making the loops test require the full context header
to fit, rejecting sym if its header runs past end, and bound the
substitute name against the actual position of sym->PathBuffer rather
than a fixed offset.

Because sub_offs and sub_len are 16bits, the pointer math will not
overflow here with the new greater-than.

Weakness: CWE-125 (Out-of-bounds Read)

## Which versions are affected by CVE-2026-31613?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2026-31613?

Apply the vendor's patch.

## Is CVE-2026-31613 being exploited?

There is no known exploitation of CVE-2026-31613 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-31613 and fix it if it is affected.

What it is: CVE-2026-31613 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2026-31613 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-31613/ (Markdown: https://insights.sbomify.com/CVE-2026-31613/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-31613
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31613
- OSV: https://osv.dev/vulnerability/CVE-2026-31613

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-31613/
Summaries are generated and may contain mistakes; the official description above is the record.