CVE-2026-31478: Linux Kernel ksmbd Buffer Vulnerability

CVE-2026-31478 Overview

A vulnerability has been identified in the Linux kernel's ksmbd (kernel SMB server) component where hardcoded header length values in the smb2_calc_max_out_buf_len() function lead to incorrect buffer management. Following changes to support read compound operations (commit e2b76ab8b5c9), the response buffer management was redesigned to use a dynamic iov array. However, certain call sites continued using hardcoded magic numbers instead of the correct offsetof() values for the ->Buffer field offset in response structures.

Critical Impact

Improper buffer length calculations in the SMB2 protocol handler could lead to memory corruption or information disclosure when processing SMB2 requests on Linux systems running ksmbd.

Affected Products

• Linux kernel with ksmbd module enabled
• Systems using in-kernel SMB3 file server (ksmbd)
• Linux distributions with ksmbd configurations

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-31478 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31478

Vulnerability Analysis

The vulnerability exists in the ksmbd module's buffer length calculation logic. After the introduction of dynamic iov array support for read compound operations (commit e2b76ab8b5c9), the smb2_calc_max_out_buf_len() function expects the second argument (hdr2_len) to represent the offset of the ->Buffer field in the SMB2 response structure. However, several call sites were not updated to use the proper offsetof() macro and continued passing hardcoded numeric values.

This mismatch between expected and actual parameter semantics can result in incorrect buffer size calculations. When the calculated buffer length is incorrect, it may lead to buffer overruns when writing response data or premature truncation of legitimate responses.

Root Cause

The root cause stems from an incomplete code migration following architectural changes to the ksmbd response buffer management system. When dynamic iov arrays were introduced for read compound support, the function interface contract changed but not all calling code was updated to reflect this new expectation. The use of hardcoded "magic numbers" instead of proper structure offsets via offsetof() creates a fragile dependency that breaks when structure layouts change.

Attack Vector

An attacker with network access to a system running ksmbd could potentially craft malicious SMB2 requests that trigger the vulnerable code path. The incorrect buffer calculations could be exploited during SMB2 compound read operations where the miscalculated buffer length leads to memory corruption or information leakage in the kernel response buffer handling.

The vulnerability requires the target system to have ksmbd enabled and accepting SMB connections. Exploitation complexity depends on the specific kernel version and configuration, as well as the exact nature of the buffer calculation error in each call site.

Detection Methods for CVE-2026-31478

Indicators of Compromise

• Unexpected ksmbd kernel module crashes or panics during SMB2 operations
• Anomalous SMB2 compound read requests from untrusted network sources
• Memory corruption warnings or kernel oops messages related to ksmbd
• Unusual network traffic patterns targeting SMB/CIFS ports (445/tcp)

Detection Strategies

• Monitor kernel logs for ksmbd-related warnings, errors, or crash reports
• Implement network intrusion detection rules for malformed SMB2 compound requests
• Use kernel debugging tools to detect buffer overflows in ksmbd module
• Track SMB2 connection patterns for anomalous compound read operations

Monitoring Recommendations

• Enable kernel auditing for ksmbd module operations and errors
• Configure network monitoring on SMB ports to detect exploitation attempts
• Set up alerting for kernel panics or unexpected ksmbd module behavior
• Review system logs regularly for signs of SMB-based attack patterns

How to Mitigate CVE-2026-31478

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• If patching is not immediately possible, consider disabling ksmbd if not required
• Restrict network access to SMB services to trusted hosts only
• Monitor systems for signs of exploitation attempts

Patch Information

Multiple kernel patches have been released to address this vulnerability by replacing hardcoded header length values with proper offsetof() calculations. The fixes ensure that smb2_calc_max_out_buf_len() receives the correct offset values for the ->Buffer field in SMB2 response structures.

Patches are available from the Linux kernel stable tree:

• Kernel Git Commit 0e55f63
• Kernel Git Commit 4cb537a
• Kernel Git Commit 6aef176
• Kernel Git Commit 70b4c41
• Kernel Git Commit 80824c7
• Kernel Git Commit 9a71666
• Kernel Git Commit c3a89e3

Workarounds

• Disable the ksmbd kernel module if SMB server functionality is not required: modprobe -r ksmbd
• Use firewall rules to restrict SMB access to trusted networks only
• Consider using userspace Samba instead of ksmbd until patches are applied
• Implement network segmentation to isolate systems running ksmbd

# Disable ksmbd module and prevent loading
echo "blacklist ksmbd" >> /etc/modprobe.d/ksmbd-blacklist.conf
modprobe -r ksmbd

# Restrict SMB access via firewall (iptables example)
iptables -A INPUT -p tcp --dport 445 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j DROP