{"id":"CVE-2026-31432","title":"ksmbd: fix OOB write in QUERY_INFO for compound requests","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 < 533f84264e28c54a79257ea87d2f94a0fcc9a611","Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 850452af77f55d185f9445e1f7a1db53c5e4aad4","Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09","Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 075ea208c648cc2bcd616295b711d3637c61de45","Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 515c2daab46021221bdf406bef19bc90a44ec617","Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < fda9522ed6afaec45cabc198d8492270c394c7bc","Linux f2283680a80571ca82d710bc6ecd8f8beac67d63","Linux >= 6.1.71 < 6.1.191","Linux >= 5.15.145 < 5.16","Linux 6.6"],"published":"2026-04-22","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:24:13.087Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31432","references":[{"url":"https://git.kernel.org/stable/c/533f84264e28c54a79257ea87d2f94a0fcc9a611"},{"url":"https://git.kernel.org/stable/c/850452af77f55d185f9445e1f7a1db53c5e4aad4"},{"url":"https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09"},{"url":"https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45"},{"url":"https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617"},{"url":"https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc"}],"tags":["cve.org"],"epss":0.00546,"epssPercentile":0.46068,"ingestedAt":"2026-11-05T15:02:32.233Z","slug":"CVE-2026-31432","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning.\n\n## Affected\n\n- `Linux >= 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 < 533f84264e28c54a79257ea87d2f94a0fcc9a611`\n- `Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 850452af77f55d185f9445e1f7a1db53c5e4aad4`\n- `Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09`\n- `Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 075ea208c648cc2bcd616295b711d3637c61de45`\n- `Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 515c2daab46021221bdf406bef19bc90a44ec617`\n- `Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < fda9522ed6afaec45cabc198d8492270c394c7bc`\n- `Linux f2283680a80571ca82d710bc6ecd8f8beac67d63`\n- `Linux >= 6.1.71 < 6.1.191`\n- `Linux >= 5.15.145 < 5.16`\n- `Linux 6.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}