CVE-2026-31705 Overview
CVE-2026-31705 is an out-of-bounds write vulnerability [CWE-787] in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the smb2_get_ea() function, which handles Extended Attribute (EA) responses for SMB2 QUERY_INFO requests. A missing bounds check before the 4-byte alignment memset() allows 1-3 NUL bytes to be written past the allocated kernel buffer. The condition is reachable through compound SMB2 requests, where the response buffer is shared across commands. The vulnerability affects multiple stable Linux kernel branches and was resolved through five upstream commits in git.kernel.org.
Critical Impact
Remote, unauthenticated attackers reaching an exposed ksmbd service can corrupt adjacent kernel heap memory, enabling potential code execution or kernel-level denial of service.
Affected Products
- Linux Kernel (multiple stable branches with ksmbd enabled)
- Distributions shipping ksmbd as the in-kernel SMB server
- Systems exposing SMB shares via ksmbd over the network
Discovery Timeline
- 2026-05-01 - CVE-2026-31705 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-31705
Vulnerability Analysis
The smb2_get_ea() function constructs SMB2 QUERY_INFO responses containing Extended Attribute entries. After writing each EA entry, the code applies 4-byte alignment padding using memset(). The bounds check on buf_free_len is performed before the value memcpy(), but the alignment memset() fires unconditionally afterward without checking remaining buffer space.
When an EA value exactly fills the remaining buffer such that buf_free_len == 0 after value subtraction, the alignment memset() writes 1-3 NUL bytes past the allocation boundary. The corrupted memory belongs to adjacent kernel heap objects allocated through kvmalloc.
The bug pattern matches earlier ksmbd fixes in commit beef2634f81f ("ksmbd: fix potencial OOB in get_file_all_info() for compound requests") and commit fda9522ed6af ("ksmbd: fix OOB write in QUERY_INFO for compound requests"). Both prior commits added bounds checks before unconditional writes in QUERY_INFO response handlers.
Root Cause
The root cause is an incomplete bounds-check pattern. The validation logic guards the variable-length value copy but omits validation for the fixed alignment padding that follows. In compound SMB2 requests where a preceding command (such as READ) consumes most of the shared response buffer, the QUERY_INFO EA response operates with a tight remainder, making the off-by-few overflow reliably triggerable.
Attack Vector
An attacker reachable to the SMB service can craft a compound SMB2 request combining a buffer-consuming operation with a QUERY_INFO call requesting EA data sized to fill the remaining buffer exactly. The attack requires no authentication context beyond what the ksmbd service exposes for connection establishment. Successful exploitation corrupts kernel heap memory adjacent to the response buffer, with consequences ranging from kernel panic to potential privilege escalation depending on heap layout.
The vulnerability is described in upstream kernel commit logs. See the Linux Kernel Commit Log for the patch implementation.
Detection Methods for CVE-2026-31705
Indicators of Compromise
- Unexpected kernel oops, panic, or BUG: messages referencing ksmbd or smb2_get_ea in dmesg or /var/log/kern.log
- KASAN reports flagging out-of-bounds writes within ksmbd request handlers
- Anomalous SMB2 compound requests pairing READ operations with QUERY_INFO EA queries against the same handle
Detection Strategies
- Inspect SMB2 traffic for compound requests where READ and QUERY_INFO commands share a response buffer with EA data sized to alignment boundaries
- Enable kernel hardening features such as KASAN or SLUB_DEBUG in test environments to surface OOB writes triggered against ksmbd
- Audit running kernel versions against the patched commits listed in git.kernel.org stable branches
Monitoring Recommendations
- Monitor exposure of TCP port 445 on Linux hosts running ksmbd and restrict to trusted network segments
- Alert on ksmbd.ko module loads on hosts not intended to serve SMB shares
- Track kernel crash telemetry referencing the ksmbd module across the fleet for anomalies aligning with SMB client activity
How to Mitigate CVE-2026-31705
Immediate Actions Required
- Update the Linux kernel to a version containing the fix from one of the upstream commits: 30010c952077, 790304c02bf9, 922d48fe8c19, 98f3de6ef4ef, or ffbce350c6fd
- Identify all hosts loading the ksmbd module and prioritize patching those exposed to untrusted networks
- Apply distribution kernel updates as they are released by the relevant Linux vendor
Patch Information
The fix adds a bounds check before the alignment memset() to ensure buf_free_len can accommodate the padding bytes. Patch commits are published at the Linux Kernel Stable Tree. Distribution maintainers are backporting the fix into supported stable kernel branches.
Workarounds
- Unload the ksmbd module with modprobe -r ksmbd on systems that do not require in-kernel SMB serving
- Migrate file sharing to userspace Samba (smbd) until kernel patches are applied
- Block inbound TCP port 445 at the host or perimeter firewall to limit reachability of ksmbd
# Disable ksmbd until patched kernel is deployed
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd
# Block SMB at the host firewall
sudo iptables -A INPUT -p tcp --dport 445 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
