CVE-2026-31706: Linux Kernel ksmbd DOS Vulnerability

CVE-2026-31706 Overview

CVE-2026-31706 is a high-severity vulnerability in the Linux kernel's ksmbd SMB server implementation. The flaw exists in the smb_inherit_dacl() function, which trusts the on-disk num_aces value from a parent directory's DACL extended attribute without validating it against the declared pdacl_size. An authenticated SMB client can trigger an oversized heap allocation of approximately 8 MB by tampering with the security.NTACL xattr on the backing filesystem. The issue also enables potential size_t multiplication overflow on 32-bit kernels and processes under-sized ACE records due to a weak per-ACE size check.

Critical Impact
Authenticated attackers can corrupt parent directory NTACL xattrs to force uninitialized 8 MB heap allocations and partially populated buffers, leading to memory disclosure, denial of service, or potential heap exploitation in the kernel.

Affected Products

Linux Kernel (ksmbd module) — versions prior to the patches in commits 063a7409, 3e4e2ea2, 3e5360b4, and 59c32aba
Linux distributions shipping vulnerable ksmbd builds with vfs objects = acl_xattr enabled
32-bit Linux kernel builds are additionally exposed to integer overflow in the allocation size calculation

Discovery Timeline

2026-05-01 - CVE-2026-31706 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31706

Vulnerability Analysis

The vulnerability resides in smb_inherit_dacl() within the Linux kernel's ksmbd SMB3 server. The function reads num_aces as a u16 value via le16_to_cpu(parent_pdacl->num_aces) and uses it directly to size a heap allocation: aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...). No consistency check verifies num_aces against the declared pdacl_size.

An authenticated client whose parent directory's security.NTACL xattr is tampered, for example through offline xattr corruption, can present num_aces = 0xFFFF with minimal actual ACE data. The resulting kmalloc request reaches roughly 8 MB and uses kmalloc rather than kzalloc, leaving the buffer uninitialized. The subsequent ACE walk loop only partially populates the allocation. The same arithmetic can overflow the three-way size_t multiplication on 32-bit kernels.

The ACE walk also relies on offsetof(struct smb_ace, access_req) as its minimum size guard rather than the true minimum on-wire ACE size, and it does not reject ACEs whose declared size falls below the minimum.

Root Cause

The root cause is missing input validation [CWE-noinfo] of attacker-influenced metadata read from a filesystem extended attribute. ksmbd treats num_aces as trusted while it is parsed from a structure that an authenticated user can influence through xattr manipulation.

Attack Vector

An authenticated SMB user creates a parent directory over SMB so ksmbd writes a valid security.NTACL xattr. The attacker rewrites the NTACL blob on the backing filesystem to set num_aces = 0xFFFF while preserving posix_acl_hash bytes so ksmbd_vfs_get_sd_xattr()'s hash check still passes. A subsequent SMB2 CREATE on a child of that directory drives smb2_open() into smb_inherit_dacl(), which triggers the oversized allocation. The reproduction was confirmed on UML with KASAN and LOCKDEP, producing a page allocator warning at mm/page_alloc.c:5226 in __alloc_frozen_pages_noprof.

Detection Methods for CVE-2026-31706

Indicators of Compromise

Kernel warnings originating from __alloc_frozen_pages_noprof with call stacks containing smb_inherit_dacl+0x394/0x2430 and smb2_open
Unexpected large kmalloc requests from the ksmbd-io workqueue via handle_ksmbd_work
Modifications to security.NTACL xattrs on directories exported by ksmbd shares configured with vfs objects = acl_xattr

Detection Strategies

Monitor dmesg and kernel audit logs for page allocator warnings tied to the ksmbd workqueue and smb_inherit_dacl symbol
Audit extended attributes on shared directories for NTACL blobs whose num_aces field is inconsistent with the declared pdacl_size
Track SMB2 CREATE operations targeting directories whose backing-filesystem xattrs were recently modified outside of the ksmbd code path

Monitoring Recommendations

Enable kernel auditing of setxattr operations on security.NTACL for filesystems backing SMB shares
Forward kernel ring buffer events to a centralized log platform and alert on ksmbd stack traces involving smb_inherit_dacl
Inventory hosts running ksmbd and confirm patch level against the upstream stable commits referenced in the advisory

How to Mitigate CVE-2026-31706

Immediate Actions Required

Apply the upstream ksmbd patches from kernel.org commits 063a7409, 3e4e2ea2, 3e5360b4, and 59c32aba
Restrict authenticated SMB access to trusted users while patches are deployed
Audit and reset suspicious security.NTACL xattrs on directories exposed through ksmbd shares

Patch Information

The upstream fix validates num_aces against pdacl_size using the same formula as parse_dacl(), replaces the raw kmalloc(sizeof * num_aces * 2) with kmalloc_array(num_aces * 2, sizeof(...)) for overflow-safe allocation, and tightens the per-ACE loop guard to require the minimum valid ACE size of offsetof(smb_ace, sid) + CIFS_SID_BASE_SIZE. With the patch applied, tampered values are rejected with -EINVAL before any large allocation runs, and smb2_open() falls back to smb2_create_sd_buffer() so the child file is created with a default security descriptor.

Workarounds

Disable ksmbd on hosts that do not require an SMB server until patches are applied
Remove vfs objects = acl_xattr from ksmbd share configurations to avoid the smb_inherit_dacl() path where operationally feasible
Limit write access to backing filesystems so unprivileged users cannot rewrite security.NTACL xattrs out-of-band

bash

# Disable the ksmbd kernel module on unaffected systems
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf