In the Linux kernel, the following vulnerability has been resolved:
ksmbd: require 3 sub-authorities before reading sub_auth[2]
parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on
match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is
the prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares
only min(num_subauth, 2) sub-authorities so a client SID with
num_subauth = 2 and sub_auth = {88, 3} will match.
If num_subauth = 2 and the ACE is placed at the very end of the security
descriptor, sub_auth[2] will be 4 bytes past end_of_acl. The
out-of-band bytes will then be masked to the low 9 bits and applied as
the file's POSIX mode, probably not something that is good to have
happen.
Fix this up by forcing the SID to actually carry a third sub-authority
before reading it at all.
References
Configurations
Configuration 1 (hide)
|
History
29 Apr 2026, 16:56
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux
Linux linux Kernel |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://git.kernel.org/stable/c/08f9e6d899b5c834bbcc239eae1bed58d9b15d2c - Patch | |
| References | () https://git.kernel.org/stable/c/46bbcd3ebfb3549c8da1838fc4493e79bd3241e7 - Patch | |
| References | () https://git.kernel.org/stable/c/53370cf9090777774e07fd9a8ebce67c6cc333ab - Patch | |
| References | () https://git.kernel.org/stable/c/9401f86a224f37b50e6a3ccf1d46a70d5ef8af0a - Patch | |
| References | () https://git.kernel.org/stable/c/b5b5d5936a50497fb151c0b122899a6894721c2b - Patch | |
| References | () https://git.kernel.org/stable/c/d2454f4a002d08560a60f214f392e6491cf11560 - Patch |
27 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.6 |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Apr 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 15:16
Updated : 2026-04-29 16:56
NVD link : CVE-2026-31611
Mitre link : CVE-2026-31611
CVE.ORG link : CVE-2026-31611
JSON object : View
Products Affected
linux
- linux_kernel
CWE