{"id":"CVE-2026-31433","state":"PUBLISHED","title":"ksmbd: fix potencial OOB in get_file_all_info() for compound requests","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial OOB in get_file_all_info() for compound requests\n\nWhen a compound request consists of QUERY_DIRECTORY + QUERY_INFO\n(FILE_ALL_INFORMATION) and the first command consumes nearly the entire\nmax_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()\nwith PATH_MAX, causing out-of-bounds write beyond the response buffer.\nIn get_file_all_info(), there was a missing validation check for\nthe client-provided OutputBufferLength before copying the filename into\nFileName field of the smb2_file_all_info structure.\nIf the filename length exceeds the available buffer space, it could lead to\npotential buffer overflows or memory corruption during smbConvertToUTF16\nconversion. This calculating the actual free buffer size using\nsmb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is\ninsufficient and updating smbConvertToUTF16 to use the actual filename\nlength (clamped by PATH_MAX) to ensure a safe copy operation.","publishedAt":"2026-04-22T08:15:11.719Z","updatedAt":"2026-08-05T12:22:27.773Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","status":"affected","lessThan":"3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7","versionType":"git"},{"version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","status":"affected","lessThan":"4cca3eff2099b18672934a39cee70aed835d652c","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"7aec5a769d2356cbf344d85bcfd36de592ac96a5","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"b0cd9725fe2bcc9f37d096b132318a9060373f5d","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"9d7032851d6f5adbe2739601ca456c0ad3b422f0","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"beef2634f81f1c086208191f7228bce1d366493d","versionType":"git"},{"version":"5.15.145","status":"affected","lessThan":"5.15.203","versionType":"semver"},{"version":"6.1.71","status":"affected","lessThan":"6.1.168","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]}],"references":["https://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7","https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652c","https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe","https://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5","https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5d","https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0","https://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31433.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31433","state":"PUBLISHED","datePublished":"2026-04-22T08:15:11.719Z","dateUpdated":"2026-08-05T12:22:27.773Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.089Z"},"containers":{"cna":{"title":"ksmbd: fix potencial OOB in get_file_all_info() for compound requests","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial OOB in get_file_all_info() for compound requests\n\nWhen a compound request consists of QUERY_DIRECTORY + QUERY_INFO\n(FILE_ALL_INFORMATION) and the first command consumes nearly the entire\nmax_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()\nwith PATH_MAX, causing out-of-bounds write beyond the response buffer.\nIn get_file_all_info(), there was a missing validation check for\nthe client-provided OutputBufferLength before copying the filename into\nFileName field of the smb2_file_all_info structure.\nIf the filename length exceeds the available buffer space, it could lead to\npotential buffer overflows or memory corruption during smbConvertToUTF16\nconversion. This calculating the actual free buffer size using\nsmb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is\ninsufficient and updating smbConvertToUTF16 to use the actual filename\nlength (clamped by PATH_MAX) to ensure a safe copy operation."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","status":"affected","lessThan":"3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7","versionType":"git"},{"version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","status":"affected","lessThan":"4cca3eff2099b18672934a39cee70aed835d652c","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"7aec5a769d2356cbf344d85bcfd36de592ac96a5","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"b0cd9725fe2bcc9f37d096b132318a9060373f5d","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"9d7032851d6f5adbe2739601ca456c0ad3b422f0","versionType":"git"},{"version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","status":"affected","lessThan":"beef2634f81f1c086208191f7228bce1d366493d","versionType":"git"},{"version":"5.15.145","status":"affected","lessThan":"5.15.203","versionType":"semver"},{"version":"6.1.71","status":"affected","lessThan":"6.1.168","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7"},{"url":"https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652c"},{"url":"https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe"},{"url":"https://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5"},{"url":"https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5d"},{"url":"https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0"},{"url":"https://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - ksmbd is the in-kernel SMB server listening on TCP port 445, directly reachable over the network by any SMB client.\nAC:L - The attacker can reliably construct a compound request (QUERY_DIRECTORY + QUERY_INFO) where the first command consumes most of the buffer, then trigger the OOB write in the second command with no race conditions or special prerequisites.\nPR:L - The vulnerability requires an authenticated SMB session and tree connection; smb2_check_user_session() and smb2_get_ksmbd_tcon() are enforced before QUERY_INFO is processed, so the attacker needs valid SMB credentials.\nUI:N - No user interaction is required; the attacker sends the malicious compound SMB request directly over the network.\nS:U - The vulnerability stays within the kernel security scope; there is no crossing of a security boundary like VM escape or sandbox escape.\nC:H - The out-of-bounds heap write of up to ~8KB of attacker-influenced data into kernel heap can be leveraged to corrupt adjacent objects and create read primitives for arbitrary kernel memory disclosure.\nI:H - The OOB heap write corrupts adjacent kernel heap objects with partially attacker-controlled data (UTF-16 filename), which can be exploited via heap shaping for arbitrary write primitives and code execution.\nA:H - The out-of-bounds write corrupts kernel heap memory, which will reliably cause kernel crashes or panics."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:22:27.773Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.145","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.71","versionEndExcluding":"6.1.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}