---
id: CVE-2026-31614
title: 'smb: client: fix off-by-8 bounds check in check_wsl_eas()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix off-by-8 bounds check in check_wsl_eas()

  The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA
  name and value, but ea_data sits at off…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7449d736bbbd160c76b01b8fcdf72f58a8757d4b <
    bfbc74df8bbe095b3ed68f6d4487b368af087890
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    5cc0574c84aa73946ade587c41e81757b8b01cb5
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    b2b76d09a64c538c57006180103fc1841e8cfa66
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    a893f1757d9a4009e4a8d7ceb2312142fe29cea4
  - >-
    Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 <
    3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b
  - Linux >= 6.6.32 < 6.6.136
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:22:40.298481Z'
published: '2026-04-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:19.620Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31614'
references:
  - url: 'https://git.kernel.org/stable/c/bfbc74df8bbe095b3ed68f6d4487b368af087890'
  - url: 'https://git.kernel.org/stable/c/5cc0574c84aa73946ade587c41e81757b8b01cb5'
  - url: 'https://git.kernel.org/stable/c/b2b76d09a64c538c57006180103fc1841e8cfa66'
  - url: 'https://git.kernel.org/stable/c/ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18'
  - url: 'https://git.kernel.org/stable/c/a893f1757d9a4009e4a8d7ceb2312142fe29cea4'
  - url: 'https://git.kernel.org/stable/c/3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02286
ingestedAt: '2026-11-06T15:54:04.055Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix off-by-8 bounds check in check_wsl_eas()

The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA
name and value, but ea_data sits at offset sizeof(struct
smb2_file_full_ea_info) = 8 from ea, not at offset 0.  The strncmp()
later reads ea->ea_data[0..nlen-1] and the value bytes follow at
ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1
+ vlen.  Isn't pointer math fun?

The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the
8-byte header is in bounds, but since the last EA is placed within 8
bytes of the end of the response, the name and value bytes are read past
the end of iov.

Fix this mess all up by using ea->ea_data as the base for the bounds
check.

An "untrusted" server can use this to leak up to 8 bytes of kernel heap
into the EA name comparison and influence which WSL xattr the data is
interpreted as.

## Affected

- `Linux >= 7449d736bbbd160c76b01b8fcdf72f58a8757d4b < bfbc74df8bbe095b3ed68f6d4487b368af087890`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < 5cc0574c84aa73946ade587c41e81757b8b01cb5`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < b2b76d09a64c538c57006180103fc1841e8cfa66`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < a893f1757d9a4009e4a8d7ceb2312142fe29cea4`
- `Linux >= ea41367b2a602f602ea6594fc4a310520dcc64f4 < 3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b`
- `Linux >= 6.6.32 < 6.6.136`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.