In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate the whole DACL before rewriting it in cifsacl
build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a
server-supplied dacloffset and then use the incoming ACL to rebuild the
chmod/chown security descriptor.
The original fix only checked that the struct smb_acl header fits before
reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate
header-field OOB read, but the rewrite helpers still walk ACEs based on
pdacl->num_aces with no structural validation of the incoming DACL body.
A malicious server can return a truncated DACL that still contains a
header, claims one or more ACEs, and then drive
replace_sids_and_copy_aces() or set_chmod_dacl() past the validated
extent while they compare or copy attacker-controlled ACEs.
Factor the DACL structural checks into validate_dacl(), extend them to
validate each ACE against the DACL bounds, and use the shared validator
before the chmod/chown rebuild paths. parse_dacl() reuses the same
validator so the read-side parser and write-side rewrite paths agree on
what constitutes a well-formed incoming DACL.
References
Configurations
History
17 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 May 2026, 06:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 May 2026, 20:23
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo | |
| References | () https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a - Patch | |
| References | () https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8 - Patch |
03 May 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
01 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-01 14:16
Updated : 2026-05-17 16:16
NVD link : CVE-2026-31709
Mitre link : CVE-2026-31709
CVE.ORG link : CVE-2026-31709
JSON object : View
Products Affected
linux
- linux_kernel
CWE