Skip to content
Fencer Vulns
critical 9.8

CVE-2026-31705 in the critical feed json

ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

published 2026-05-01 6 mo ago modified 2026-10-15 25 d ago also EUVD-2026-26514

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space.

When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory.

Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes.

This is the same bug pattern fixed by commit beef2634f81f ("ksmbd: fix potencial OOB in get_file_all_info() for compound requests") and commit fda9522ed6af ("ksmbd: fix OOB write in QUERY_INFO for compound requests"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.

Patch / fix

  • Linux Linux 5.16, 6.1.175, 6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1
  • linux Debian 12 6.1.176-1
  • linux Debian 13 6.12.85-1
  • linux Debian 14 7.0.3-1

debian advisories DEBIAN-CVE-2026-31705

  • linux Ubuntu 22.04 LTS 5.15.0-187.197
  • linux Ubuntu 24.04 LTS 6.8.0-136.136
  • linux Ubuntu 26.04 LTS 7.0.0-27.27
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1113.120
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1061.64
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1008.8
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1114.124
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1064.72

ubuntu advisories UBUNTU-CVE-2026-31705

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-source openSUSE Tumbleweed 7.0.7-1.1

opensuse advisories openSUSE-SU-2026:10793-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-31705 updated

kernel: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-295-16 updated cvss 9.8

Siemens SIMATIC S7-1500 TM MFP

  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.