Executive brief
A vulnerability exists in the Linux kernel's SMB client, which is used to connect to network file shares. A malicious or compromised server could send specially crafted security data (DACLs) that causes the client to perform operations outside of intended memory boundaries. This could lead to a system crash, data corruption, or potentially unauthorized access to sensitive information on the client machine.
Technical details
An out-of-bounds (OOB) read/write vulnerability exists in the Linux kernel SMB client (cifsacl) within build_sec_desc() and id_mode_to_cifs_acl(). The issue stems from insufficient structural validation of server-supplied DACLs. While the code previously checked if the smb_acl header fit, it did not validate the entire DACL body or individual Access Control Entries (ACEs) against the DACL bounds. A malicious server can return a truncated DACL with a valid header but a high 'num_aces' count, causing helpers like replace_sids_and_copy_aces() or set_chmod_dacl() to iterate past the validated buffer. This has been fixed by introducing a comprehensive validate_dacl() function that verifies each ACE against the DACL's reported size.
Affected products
- Linux Linux Kernel 5.12 to 7.0.2
Timeline
- 2026-05-01: advisory: Initial publication of CVE-2026-31709
- 2026-04-22: patched: Fix committed to Linux stable tree