CVE-2026-31709 smb: client: validate the whole DACL before rewriting it in cifsacl
A malicious SMB server can trigger out-of-bounds memory access in the Linux kernel SMB client by sending a malformed DACL, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-31709?
CVE-2026-31709 is a high-severity memory corruption vulnerability in Linux kernel, published on 1 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate the whole DACL before rewriting it in cifsacl
build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor.
The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL body.
A malicious server can return a truncated DACL that still contains a header, claims one or more ACEs, and then drive replace_sids_and_copy_aces() or set_chmod_dacl() past the validated extent while they compare or copy attacker-controlled ACEs.
Factor the DACL structural checks into validate_dacl(), extend them to validate each ACE against the DACL bounds, and use the shared validator before the chmod/chown rebuild paths. parse_dacl() reuses the same validator so the read-side parser and write-side rewrite paths agree on what constitutes a well-formed incoming DACL.
Which versions are affected by CVE-2026-31709?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31709?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31709 being exploited?
There is no known exploitation of CVE-2026-31709 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-85386, BELL-CVE-2026-31709, DEBIAN-CVE-2026-31709, GHSA-8hp2-qmc6-f97h, ROOT-OS-DEBIAN-12-CVE-2026-31709, ROOT-OS-DEBIAN-13-CVE-2026-31709 and 3 more.