CVE-2026-31712 - Vulnerability Details

- ksmbd: require minimum ACE size in smb_check_perm_dacl()

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: require minimum ACE size in smb_check_perm_dacl()

Both ACE-walk loops in smb_check_perm_dacl() only guard against an
under-sized remaining buffer, not against an ACE whose declared
`ace->size` is smaller than the struct it claims to describe:

if (offsetof(struct smb_ace, access_req) > aces_size)
break;
ace_size = le16_to_cpu(ace->size);
if (ace_size > aces_size)
break;

The first check only requires the 4-byte ACE header to be in bounds;
it does not require access_req (4 bytes at offset 4) to be readable.
An attacker who has set a crafted DACL on a file they own can declare
ace->size == 4 with aces_size == 4, pass both checks, and then

granted |= le32_to_cpu(ace->access_req); /* upper loop */
compare_sids(&sid, &ace->sid); /* lower loop */

reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at
offset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES
* 4 bytes).

Tighten both loops to require

ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE

which is the smallest valid on-wire ACE layout (4-byte header +
4-byte access_req + 8-byte sid base with zero sub-auths). Also
reject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES
before letting compare_sids() dereference sub_auth[] entries.

parse_sec_desc() already enforces an equivalent check (lines 441-448);
smb_check_perm_dacl() simply grew weaker validation over time.

Reachability: authenticated SMB client with permission to set an ACL
on a file. On a subsequent CREATE against that file, the kernel
walks the stored DACL via smb_check_perm_dacl() and triggers the
OOB read. Not pre-auth, and the OOB read is not reflected to the
attacker, but KASAN reports and kernel state corruption are
possible.

Published: 2026-05-01

Score: 8.3 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ksmbd SMB server contains a flaw in smb_check_perm_dacl() where the size of Access Control Entries (ACEs) is insufficiently validated. An attacker with the ability to set a custom ACL on a file they own can craft an ACE whose declared size is only the 4‑byte header. The function’s checks then succeed, but subsequent reads of fields beyond the real end of the ACE (the access request and SID structures) trigger an out‑of‑bounds read. This read can corrupt kernel memory, which may result in a crash or other unreliable system behavior. The vulnerability does not directly leak data and is not pre‑authentication; however, kernel state corruption is possible, and the KASAN detector may report the fault.

Affected Systems

Any Linux kernel containing the ksmbd SMB implementation prior to the patch that introduced stricter ACE size validation is affected. The issue spans all configurations that enable smbfs and process ACLs for SMB shares; no specific distribution version is singled out, so any kernel version before the recent commit is considered vulnerable.

Risk and Exploitability

The flaw is not listed in the CISA KEV catalog and EPSS score is < 1%, with a CVSS score of 8.3. Reachability requires an authenticated SMB client that can modify the ACL on a file they own. After the ACL is stored, a subsequent CREATE operation on that file causes the kernel to walk the stored DACL and trigger the out‑of‑bounds read, potentially leading to kernel memory corruption or a crash. Because the vulnerability does not provide a direct data exfiltration path, the primary risk is system instability and possible denial of service. The likelihood of exploitation is uncertain, but the potential impact on availability and integrity is significant.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 90089584b2e25c4510b7b987387b4405f0673ece
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 151b1799861fde38087c08f613abc2843ef597b0
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< d07b26f39246a82399661936dd0c853983cfade7

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.12.84`	unaffected	≤ 6.12.*
`6.18.25`	unaffected	≤ 6.18.*
`7.0.2`	unaffected	≤ 7.0.*
`7.1-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c)`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,90089584b2e25c4510b7b987387b4405f0673ece)`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,151b1799861fde38087c08f613abc2843ef597b0)`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,d07b26f39246a82399661936dd0c853983cfade7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	semver	—
`[6.12.84,6.12.*]`	unaffected	generic	—
`[6.18.25,6.18.*]`	unaffected	generic	—
`[7.0.2,7.0.*]`	unaffected	generic	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ksmbd ACL size validation fix.
If a kernel upgrade is not immediately possible, disable ACL manipulation for SMB shares by configuring the share options to disallow setting ACLs.
Restrict SMB client permissions so that only trusted administrators can modify ACLs, and monitor KASAN logs for reports of out‑of‑bounds read errors.

Generated by OpenCVE AI on May 3, 2026 at 07:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00043.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/151b1799861fde38087c08f613abc2843ef597b0
https://git.kernel.org/stable/c/90089584b2e25c4510b7b987387b4405f0673ece
https://git.kernel.org/stable/c/95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c
https://git.kernel.org/stable/c/d07b26f39246a82399661936dd0c853983cfade7
https://lore.kernel.org/linux-cve-announce/2026050123-CVE-2026-31712-b794@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31712
https://www.cve.org/CVERecord?id=CVE-2026-31712

History

Sun, 03 May 2026 06:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'}`

Sat, 02 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://lore.kernel.org/linux-cve-announce/2026050123-CVE-2026-31712-b794@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31712 https://www.cve.org/CVERecord?id=CVE-2026-31712

Fri, 01 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smb_check_perm_dacl() Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against an ACE whose declared `ace->size` is smaller than the struct it claims to describe: if (offsetof(struct smb_ace, access_req) > aces_size) break; ace_size = le16_to_cpu(ace->size); if (ace_size > aces_size) break; The first check only requires the 4-byte ACE header to be in bounds; it does not require access_req (4 bytes at offset 4) to be readable. An attacker who has set a crafted DACL on a file they own can declare ace->size == 4 with aces_size == 4, pass both checks, and then granted \|= le32_to_cpu(ace->access_req); /* upper loop / compare_sids(&sid, &ace->sid); / lower loop / reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at offset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES 4 bytes). Tighten both loops to require ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE which is the smallest valid on-wire ACE layout (4-byte header + 4-byte access_req + 8-byte sid base with zero sub-auths). Also reject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES before letting compare_sids() dereference sub_auth[] entries. parse_sec_desc() already enforces an equivalent check (lines 441-448); smb_check_perm_dacl() simply grew weaker validation over time. Reachability: authenticated SMB client with permission to set an ACL on a file. On a subsequent CREATE against that file, the kernel walks the stored DACL via smb_check_perm_dacl() and triggers the OOB read. Not pre-auth, and the OOB read is not reflected to the attacker, but KASAN reports and kernel state corruption are possible.
Title		ksmbd: require minimum ACE size in smb_check_perm_dacl()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/151b1799861fde38087c08f613abc2843ef597b0 https://git.kernel.org/stable/c/90089584b2e25c4510b7b987387b4405f0673ece https://git.kernel.org/stable/c/95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c https://git.kernel.org/stable/c/d07b26f39246a82399661936dd0c853983cfade7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-01T13:56:08.583Z

Updated: 2026-05-03T05:45:35.398Z

Reserved: 2026-03-09T15:48:24.133Z

Link: CVE-2026-31712

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-01T14:16:21.270

Modified: 2026-05-03T07:16:18.563

Link: CVE-2026-31712

Redhat

Severity :

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-31712 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-03T07:30:16Z

Weaknesses

CWE-1284

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object