smb: client: validate the whole DACL before rewriting it in cifsacl

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-31709
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-01 14:16:20 UTC
Updated2026-07-15 02:19:50 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL body. A malicious server can return a truncated DACL that still contains a header, claims one or more ACEs, and then drive replace_sids_and_copy_aces() or set_chmod_dacl() past the validated extent while they compare or copy attacker-controlled ACEs. Factor the DACL structural checks into validate_dacl(), extend them to validate each ACE against the DACL bounds, and use the shared validator before the chmod/chown rebuild paths. parse_dacl() reuses the same validator so the read-side parser and write-side rewrite paths agree on what constitutes a well-formed incoming DACL.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from ADP

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.002590000 probability, percentile 0.173940000 (date 2026-07-18)

Problem Types: NVD-CWE-noinfo | CWE-1288 | CWE-1288 Improper Validation of Consistency within Input

VersionSourceTypeScoreSeverityVector
3.1ADPCVSS7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
3.10b0ca135-0b70-47e7-9f44-1890c2a1c46cSecondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED8.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 b8603d9ae6c9087662b098619996bc4a8064319d git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 c2abdebf72000a64603ced84d36ccbd164f11391 git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 d92f3f0b22414e7515696a02224d0af55e3004a3 git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 b78db9bddc84136f6a0bb49e8883cf200dfb87a8 git Not specified
CNA Linux Linux affected bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 0a8cf165566ba55a39fd0f4de172119dd646d39a git Not specified
CNA Linux Linux affected 5.12 Not specified
CNA Linux Linux unaffected 5.12 semver Not specified
CNA Linux Linux unaffected 5.15.210 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.140 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.86 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.35 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.2 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified
ADP Red Hat Red Hat Enterprise Linux 10 unaffected 0:6.12.0-211.20.1.el10_2 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support unaffected 0:6.12.0-55.77.1.el10_0 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8 unaffected 0:4.18.0-553.126.1.rt7.467.el8_10 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 8 unaffected 0:4.18.0-553.126.1.el8_10 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9 unaffected 0:5.14.0-687.12.1.el9_8 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions unaffected 0:5.14.0-284.174.1.el9_2 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions unaffected 0:5.14.0-284.174.1.rt14.459.el9_2 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions unaffected 0:5.14.0-427.129.1.el9_4 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support unaffected 0:5.14.0-570.119.1.el9_6 * rpm Not specified
ADP Red Hat Red Hat Enterprise Linux 6 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 7 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 7 Not specified Not specified
ADP Red Hat Red Hat Enterprise Linux 9 Not specified Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
access.redhat.com/errata/RHSA-2026:21706 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
access.redhat.com/security/cve/CVE-2026-31709 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c security.access.redhat.com
access.redhat.com/errata/RHSA-2026:21556 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:23329 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:23224 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:22900 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:24343 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:21745 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
access.redhat.com/errata/RHSA-2026:22940 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
bugzilla.redhat.com/show_bug.cgi 0b0ca135-0b70-47e7-9f44-1890c2a1c46c bugzilla.redhat.com
git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
access.redhat.com/errata/RHSA-2026:23237 0b0ca135-0b70-47e7-9f44-1890c2a1c46c access.redhat.com
git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Additional Advisory Data

SourceTimeEvent
ADP2026-05-01T00:00:00.000ZReported to Red Hat.
ADP2026-05-01T00:00:00.000ZMade public.

Solutions

ADP: RHSA-2026:24343: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)

ADP: RHSA-2026:23329: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)

ADP: RHSA-2026:22940: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)

ADP: RHSA-2026:23237: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)

ADP: RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)

ADP: RHSA-2026:21556: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)

ADP: RHSA-2026:21706: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)

ADP: RHSA-2026:21745: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)

ADP: RHSA-2026:22900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)

Workarounds

ADP: To mitigate this issue, if SMB client functionality is not required, the `cifs` kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a modprobe configuration file. 1. Create a file named `/etc/modprobe.d/disable-cifs.conf` with the following content: ``` install cifs /bin/true blacklist cifs ``` 2. Regenerate the initramfs to ensure the change takes effect on boot: ```bash dracut -f -v ``` or for systems using `mkinitrd`: ```bash mkinitrd -f /boot/initramfs-$(uname -r).img $(uname -r) ``` 3. A system reboot is required for the changes to take effect. Warning: Disabling the `cifs` module will prevent the system from mounting SMB/CIFS shares. Ensure this functionality is not critical before applying this mitigation. refer: https://access.redhat.com/solutions/4117281

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report