CVE-2026-31708 smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

High 8.1 Published 1 May 2026 Updated 19 Oct 2026

A malicious SMB server can trigger an out-of-bounds read in the Linux kernel, exposing adjacent kernel heap memory to userspace.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-31708?

CVE-2026-31708 is a high-severity vulnerability in Linux kernel, published on 1 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fits within rsp_iov[1].iov_len.

A malicious server can return OutputBufferLength larger than the actual QUERY_INFO response, causing copy_to_user() to walk past the response buffer and expose adjacent kernel heap to userspace.

Guard the QUERY_INFO copy with a bounds check on the actual Buffer payload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length) rather than an open-coded addition so the guard cannot overflow on 32-bit builds.

Weakness: CWE-125

Which versions are affected by CVE-2026-31708?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-31708?

Apply the vendor's patch.

Is CVE-2026-31708 being exploited?

There is no known exploitation of CVE-2026-31708 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-85445, BELL-CVE-2026-31708, DEBIAN-CVE-2026-31708, GHSA-9grv-w29f-qpm9, ROOT-OS-DEBIAN-11-CVE-2026-31708, ROOT-OS-DEBIAN-12-CVE-2026-31708 and 3 more.