ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
Summary
| CVE | CVE-2026-31704 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-01 14:16:20 UTC |
| Updated | 2026-05-06 20:46:54 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use check_add_overflow() to prevent u16 DACL size overflow set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causing the pointer arithmetic (char *)pndace + *size to land within already-written ACEs. Subsequent writes then overwrite earlier entries, and pndacl->size gets a truncated value. Use check_add_overflow() at each accumulation point to detect the wrap before it corrupts the buffer, consistent with existing check_mul_overflow() usage elsewhere in smbacl.c. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.000180000 probability, percentile 0.048290000 (date 2026-05-05)
Problem Types: NVD-CWE-noinfo
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 8d5729350b236896f51379588d9a690b7fafb8db git | Not specified |
| CNA | Linux | Linux | affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 e1955a94b6f17f4b058afa955a6f187eb3ed7615 git | Not specified |
| CNA | Linux | Linux | affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43 git | Not specified |
| CNA | Linux | Linux | affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7 git | Not specified |
| CNA | Linux | Linux | affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 299f962c0b02d048fb45d248b4da493d03f3175d git | Not specified |
| CNA | Linux | Linux | affected 5.15 | Not specified |
| CNA | Linux | Linux | unaffected 5.15 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.136 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.84 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.25 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0.2 7.0.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/e1955a94b6f17f4b058afa955a6f187eb3ed7615 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/299f962c0b02d048fb45d248b4da493d03f3175d | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/8d5729350b236896f51379588d9a690b7fafb8db | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.