CVE-2026-31614: Linux Kernel Information Disclosure Flaw

CVE-2026-31614 Overview

CVE-2026-31614 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel SMB client. The flaw resides in the check_wsl_eas() function within the SMB client code that processes Extended Attributes (EAs) returned by a remote server. An off-by-8 error in the bounds check allows a malicious or untrusted SMB server to leak up to 8 bytes of kernel heap memory and influence which Windows Subsystem for Linux (WSL) extended attribute the data is interpreted as.

Critical Impact

A malicious SMB server can leak up to 8 bytes of kernel heap memory to an authenticated local client and influence WSL xattr interpretation, potentially enabling information disclosure and host-side impact.

Affected Products

• Linux Kernel (multiple stable branches prior to the fix commits)
• Systems mounting SMB shares using the in-kernel cifs.ko / smb client
• Distributions shipping WSL extended attribute support in the SMB client

Discovery Timeline

• 2026-04-24 - CVE-2026-31614 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-31614

Vulnerability Analysis

The vulnerability resides in check_wsl_eas() in the Linux kernel SMB client. The function validates Extended Attributes returned by an SMB server before they are interpreted as WSL xattrs. The bounds check incorrectly computes the end of the EA name and value buffer using (u8 *)ea + nlen + 1 + vlen. However, ea_data is located at offset sizeof(struct smb2_file_full_ea_info) = 8 from the start of ea, not at offset 0.

The actual end of valid data should be calculated as ea->ea_data + nlen + 1 + vlen. The prior check (u8 *)ea > end - sizeof(*ea) only verifies that the 8-byte header is within bounds. When the last EA is placed within 8 bytes of the response end, the subsequent strncmp() reads ea->ea_data[0..nlen-1] and value bytes at ea_data[nlen+1..nlen+vlen] past the end of the iov buffer.

Root Cause

The root cause is a pointer-arithmetic error. The code used the EA header base pointer instead of the EA data base pointer when computing the upper bound. This off-by-8 miscalculation permits reads beyond the response buffer when EAs are positioned near the buffer tail.

Attack Vector

The attack requires the victim to mount an SMB share controlled by an attacker-influenced server. The server returns crafted EA records whose nlen and vlen fields push the name and value bytes past the end of the response iov. The kernel then reads up to 8 bytes of adjacent heap memory during the WSL xattr name comparison. The leaked bytes can also alter which xattr the data is classified as, influencing downstream interpretation.

No verified public exploitation code is available. The vulnerability mechanism is described in the upstream commit messages referenced in the Linux Kernel stable tree.

Detection Methods for CVE-2026-31614

Indicators of Compromise

• Unexpected SMB mounts to untrusted or unknown remote servers from Linux endpoints
• Kernel log entries referencing cifs, smb2, or WSL EA parsing errors near the time of mount or file access
• Unusual file metadata operations producing inconsistent xattr values on SMB-mounted paths

Detection Strategies

• Inventory running kernel versions across Linux hosts and compare against the fixed stable branches listed in the kernel.org commit references
• Monitor mount.cifs and mount -t smb3 invocations on endpoints and servers to identify shares connecting to untrusted hosts
• Audit dmesg and journald for SMB client warnings or oops messages following EA-heavy operations

Monitoring Recommendations

• Alert on new outbound SMB sessions (TCP 445) initiated by Linux hosts to destinations outside approved file server ranges
• Track kernel package versions through configuration management to confirm patch coverage
• Correlate SMB mount events with subsequent kernel warnings to identify suspicious server behavior

How to Mitigate CVE-2026-31614

Immediate Actions Required

• Update the Linux kernel to a version containing one of the fix commits referenced on kernel.org
• Restrict SMB client mounts to known, trusted file servers via firewall egress rules on TCP 445
• Restrict local accounts that can invoke mount against arbitrary SMB shares using sudoers policy and reduced CAP_SYS_ADMIN exposure

Patch Information

Fixes are available in the upstream Linux stable tree. Refer to the following commits: 3d8b9d06bd3a, 5cc0574c84aa, a893f1757d9a, b2b76d09a64c, ba3ad159aa61, and bfbc74df8bbe. Apply the distribution kernel update that includes these patches.

Workarounds

• Avoid mounting SMB shares from untrusted servers until the kernel is patched
• Disable or unload the cifs kernel module on hosts that do not require SMB client functionality
• Block outbound SMB (TCP 445) at the network perimeter for hosts that should not access remote SMB resources

# Configuration example: block outbound SMB and unload cifs module where not needed
# Confirm current kernel version
uname -r

# Prevent automatic load of the SMB client module
echo 'install cifs /bin/true' | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo rmmod cifs 2>/dev/null || true

# Block outbound SMB at the host firewall (nftables example)
sudo nft add rule inet filter output tcp dport 445 drop