CVE-2026-31611: Linux Kernel Privilege Escalation Flaw

CVE-2026-31611 Overview

CVE-2026-31611 is an out-of-bounds read vulnerability in the Linux kernel's ksmbd (in-kernel SMB server) component. The flaw exists in the parse_dacl() function, which improperly validates the number of sub-authorities in a Security Identifier (SID) before comparing it against sid_unix_NFS_mode. When a maliciously crafted SID with only 2 sub-authorities is processed, the code reads sub_auth[2] without verifying that a third sub-authority exists, resulting in an out-of-bounds memory access that reads 4 bytes past the end of the ACL buffer.

Critical Impact
Network-accessible out-of-bounds read in the Linux kernel's ksmbd component can leak sensitive memory contents and potentially corrupt file permissions when out-of-band bytes are applied as POSIX mode bits.

Affected Products

Linux Kernel (ksmbd component)
Systems running in-kernel SMB file sharing services
Network file servers with ksmbd enabled

Discovery Timeline

2026-04-24 - CVE-2026-31611 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-31611

Vulnerability Analysis

The vulnerability resides in ksmbd's DACL (Discretionary Access Control List) parsing logic. The parse_dacl() function compares each ACE (Access Control Entry) SID against the predefined sid_unix_NFS_mode prefix (S-1-5-88-3). The comparison function compare_sids() only evaluates the minimum of num_subauth values between the two SIDs being compared.

When sid_unix_NFS_mode has num_subauth = 2, a client-supplied SID with num_subauth = 2 and sub_auth = {88, 3} will incorrectly match the prefix. Upon a successful match, the code proceeds to read sid.sub_auth[2] to extract the file mode—despite the SID only containing two sub-authorities.

If the malformed ACE is positioned at the end of the security descriptor, the attempted read of sub_auth[2] accesses 4 bytes beyond end_of_acl. These out-of-band bytes are then masked to the low 9 bits and erroneously applied as the file's POSIX permission mode, potentially granting unintended access to files.

Root Cause

The root cause is insufficient validation of the num_subauth field before accessing SID sub-authority elements. The code assumes that any SID matching the sid_unix_NFS_mode prefix will have at least 3 sub-authorities, but the comparison logic uses min() to compare only the available sub-authorities, creating a validation gap. The fix requires explicitly checking that num_subauth >= 3 before reading sub_auth[2].

Attack Vector

This vulnerability is network-exploitable by any client that can establish an SMB connection to a ksmbd server. An attacker can craft a malicious security descriptor containing an ACE with a specifically constructed SID (S-1-5-88-3 with only 2 sub-authorities) placed at the end of the ACL buffer. When the ksmbd server processes this descriptor, it performs an out-of-bounds read.

The attack does not require authentication in typical configurations where guest access or anonymous enumeration is permitted. The out-of-bounds memory may contain sensitive kernel data, and the corrupted permission bits could modify file access controls in unpredictable ways.

Detection Methods for CVE-2026-31611

Indicators of Compromise

Unusual SMB traffic containing malformed security descriptors with truncated SIDs
Unexpected file permission changes on ksmbd-served shares
Kernel log messages indicating memory access violations in ksmbd context
Anomalous SMB session behavior with crafted ACE structures

Detection Strategies

Monitor ksmbd-related kernel logs for parsing errors or memory access warnings
Implement network intrusion detection rules to identify SMB packets with abnormal SID structures (specifically SIDs with num_subauth < 3 matching the NFS mode prefix pattern)
Deploy kernel memory debugging tools (KASAN) to detect out-of-bounds accesses
Audit file permission changes on SMB shares for unauthorized modifications

Monitoring Recommendations

Enable comprehensive ksmbd debug logging during incident investigation
Configure SIEM rules to correlate SMB authentication events with file permission anomalies
Monitor network traffic for SMB connections from untrusted sources to ksmbd-enabled systems
Implement file integrity monitoring on critical directories served via ksmbd

How to Mitigate CVE-2026-31611

Immediate Actions Required

Apply the kernel security patches immediately on all systems running ksmbd
Disable ksmbd if not actively required and use Samba userspace SMB server as an alternative
Restrict network access to SMB services using firewall rules to trusted IP ranges only
Review and audit recent file permission changes on affected shares

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix enforces that a SID must have at least 3 sub-authorities before the code attempts to read sub_auth[2]. Multiple patch commits are available for different kernel branches:

Workarounds

Disable ksmbd kernel module if SMB file sharing is not required: modprobe -r ksmbd
Use Samba userspace SMB server instead of ksmbd until patching is complete
Implement network segmentation to restrict SMB access to trusted networks only
Configure firewall rules to block SMB ports (445/tcp) from untrusted sources

bash

# Disable ksmbd module and prevent loading
modprobe -r ksmbd
echo "blacklist ksmbd" >> /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB access via firewall (iptables example)
iptables -A INPUT -p tcp --dport 445 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j DROP