In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
smb2_get_ea() applies 4-byte alignment padding via memset() after
writing each EA entry. The bounds check on buf_free_len is performed
before the value memcpy, but the alignment memset fires unconditionally
afterward with no check on remaining space.
When the EA value exactly fills the remaining buffer (buf_free_len == 0
after value subtraction), the alignment memset writes 1-3 NUL bytes
past the buf_free_len boundary. In compound requests where the response
buffer is shared across commands, the first command (e.g., READ) can
consume most of the buffer, leaving a tight remainder for the QUERY_INFO
EA response. The alignment memset then overwrites past the physical
kvmalloc allocation into adjacent kernel heap memory.
Add a bounds check before the alignment memset to ensure buf_free_len
can accommodate the padding bytes.
This is the same bug pattern fixed by commit beef2634f81f ("ksmbd: fix
potencial OOB in get_file_all_info() for compound requests") and
commit fda9522ed6af ("ksmbd: fix OOB write in QUERY_INFO for compound
requests"), both of which added bounds checks before unconditional
writes in QUERY_INFO response handlers.
References
Configurations
Configuration 1 (hide)
|
History
01 Jun 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 May 2026, 20:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux
Linux linux Kernel |
|
| CWE | CWE-787 | |
| References | () https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617 - Patch | |
| References | () https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f - Patch | |
| References | () https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2 - Patch | |
| References | () https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c - Patch | |
| References | () https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b - Patch |
03 May 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
01 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-01 14:16
Updated : 2026-06-01 17:16
NVD link : CVE-2026-31705
Mitre link : CVE-2026-31705
CVE.ORG link : CVE-2026-31705
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write