CVE-2026-31478: Linux Kernel ksmbd Buffer Vulnerability

CVE-2026-31478 Overview

A vulnerability has been identified in the Linux kernel's ksmbd (kernel SMB server) component where hardcoded header length values in the smb2_calc_max_out_buf_len() function lead to incorrect buffer management. Following changes to support read compound operations (commit e2b76ab8b5c9), the response buffer management was redesigned to use a dynamic iov array. However, certain call sites continued using hardcoded magic numbers instead of the correct offsetof() values for the ->Buffer field offset in response structures.

Critical Impact
Improper buffer length calculations in the SMB2 protocol handler could lead to memory corruption or information disclosure when processing SMB2 requests on Linux systems running ksmbd.

Affected Products

Linux kernel with ksmbd module enabled
Systems using in-kernel SMB3 file server (ksmbd)
Linux distributions with ksmbd configurations

Discovery Timeline

2026-04-22 - CVE CVE-2026-31478 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31478

Vulnerability Analysis

The vulnerability exists in the ksmbd module's buffer length calculation logic. After the introduction of dynamic iov array support for read compound operations (commit e2b76ab8b5c9), the smb2_calc_max_out_buf_len() function expects the second argument (hdr2_len) to represent the offset of the ->Buffer field in the SMB2 response structure. However, several call sites were not updated to use the proper offsetof() macro and continued passing hardcoded numeric values.

This mismatch between expected and actual parameter semantics can result in incorrect buffer size calculations. When the calculated buffer length is incorrect, it may lead to buffer overruns when writing response data or premature truncation of legitimate responses.

Root Cause

The root cause stems from an incomplete code migration following architectural changes to the ksmbd response buffer management system. When dynamic iov arrays were introduced for read compound support, the function interface contract changed but not all calling code was updated to reflect this new expectation. The use of hardcoded "magic numbers" instead of proper structure offsets via offsetof() creates a fragile dependency that breaks when structure layouts change.

Attack Vector

An attacker with network access to a system running ksmbd could potentially craft malicious SMB2 requests that trigger the vulnerable code path. The incorrect buffer calculations could be exploited during SMB2 compound read operations where the miscalculated buffer length leads to memory corruption or information leakage in the kernel response buffer handling.

The vulnerability requires the target system to have ksmbd enabled and accepting SMB connections. Exploitation complexity depends on the specific kernel version and configuration, as well as the exact nature of the buffer calculation error in each call site.

Detection Methods for CVE-2026-31478

Indicators of Compromise

Unexpected ksmbd kernel module crashes or panics during SMB2 operations
Anomalous SMB2 compound read requests from untrusted network sources
Memory corruption warnings or kernel oops messages related to ksmbd
Unusual network traffic patterns targeting SMB/CIFS ports (445/tcp)

Detection Strategies

Monitor kernel logs for ksmbd-related warnings, errors, or crash reports
Implement network intrusion detection rules for malformed SMB2 compound requests
Use kernel debugging tools to detect buffer overflows in ksmbd module
Track SMB2 connection patterns for anomalous compound read operations

Monitoring Recommendations

Enable kernel auditing for ksmbd module operations and errors
Configure network monitoring on SMB ports to detect exploitation attempts
Set up alerting for kernel panics or unexpected ksmbd module behavior
Review system logs regularly for signs of SMB-based attack patterns

How to Mitigate CVE-2026-31478

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix
If patching is not immediately possible, consider disabling ksmbd if not required
Restrict network access to SMB services to trusted hosts only
Monitor systems for signs of exploitation attempts

Patch Information

Multiple kernel patches have been released to address this vulnerability by replacing hardcoded header length values with proper offsetof() calculations. The fixes ensure that smb2_calc_max_out_buf_len() receives the correct offset values for the ->Buffer field in SMB2 response structures.

Patches are available from the Linux kernel stable tree:

Workarounds

Disable the ksmbd kernel module if SMB server functionality is not required: modprobe -r ksmbd
Use firewall rules to restrict SMB access to trusted networks only
Consider using userspace Samba instead of ksmbd until patches are applied
Implement network segmentation to isolate systems running ksmbd

bash

# Disable ksmbd module and prevent loading
echo "blacklist ksmbd" >> /etc/modprobe.d/ksmbd-blacklist.conf
modprobe -r ksmbd

# Restrict SMB access via firewall (iptables example)
iptables -A INPUT -p tcp --dport 445 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j DROP