CVE-2026-31712: Linux Kernel Privilege Escalation Flaw

CVE-2026-31712 Overview

CVE-2026-31712 is an out-of-bounds read vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the smb_check_perm_dacl() function, which fails to validate the minimum size of Access Control Entries (ACEs) when walking a Discretionary Access Control List (DACL). An authenticated SMB client with permission to set an ACL on a file can craft a malformed ACE that bypasses existing bounds checks, leading the kernel to read memory beyond the allocated buffer [CWE-787].

Critical Impact
Authenticated SMB users can trigger out-of-bounds reads in the kernel by setting a crafted DACL, causing kernel state corruption and potential denial of service against the SMB file server.

Affected Products

Linux Kernel versions containing the vulnerable ksmbdsmb_check_perm_dacl() implementation
Systems running the in-kernel SMB3 server (ksmbd) module
Linux distributions with stable kernels prior to the patches in commits 151b1799, 90089584, 95e5aa3c, and d07b26f3

Discovery Timeline

2026-05-01 - CVE-2026-31712 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31712

Vulnerability Analysis

The vulnerability exists in smb_check_perm_dacl() within the ksmbd server. The function iterates through ACEs in a DACL using two loops that validate only the size of the remaining buffer, not the declared ace->size field against the minimum ACE structure size.

The existing checks confirm that the 4-byte ACE header fits in the buffer and that ace_size does not exceed aces_size. However, neither check requires the access_req field (4 bytes at offset 4) or the sid field (starting at offset 8) to be readable. An attacker who owns a file can set a DACL containing an ACE with ace->size == 4 and aces_size == 4, passing both validation checks.

When the loops then dereference ace->access_req and ace->sid, the kernel reads up to 4 bytes plus CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES * 4 bytes beyond the allocated ACE buffer. The result is kernel memory disclosure to internal state, KASAN reports, and possible kernel state corruption.

Root Cause

The root cause is insufficient input validation in the ACE-walk loops. Validation in smb_check_perm_dacl() regressed over time, while the equivalent function parse_sec_desc() already enforces a stricter minimum size check at lines 441-448. The function also fails to reject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES, allowing compare_sids() to dereference invalid sub_auth[] entries.

Attack Vector

Exploitation requires an authenticated SMB client with permission to set an ACL on a file owned by the attacker. The attacker writes a crafted DACL to the file containing an undersized ACE. On a subsequent CREATE operation against the file, ksmbd walks the stored DACL via smb_check_perm_dacl() and triggers the out-of-bounds read. The OOB read is not reflected back to the attacker, but kernel instability and corruption are possible. The attack is not pre-authentication.

// Vulnerable validation pattern (sanitized pseudocode)
if (offsetof(struct smb_ace, access_req) > aces_size)
    break;
ace_size = le16_to_cpu(ace->size);
if (ace_size > aces_size)
    break;
// Missing: ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE
granted |= le32_to_cpu(ace->access_req);   // OOB read at offset 4
compare_sids(&sid, &ace->sid);             // OOB read at offset 8+

Detection Methods for CVE-2026-31712

Indicators of Compromise

KASAN reports referencing smb_check_perm_dacl or compare_sids in kernel logs
Unexpected kernel oops, panic, or BUG: entries triggered by SMB CREATE operations
SMB clients setting unusually small or malformed DACLs prior to file access requests

Detection Strategies

Monitor dmesg and journalctl -k for KASAN slab-out-of-bounds reports involving the ksmbd module
Audit SMB protocol traffic for SET_INFO requests carrying truncated security descriptors with ACE size values close to 4 bytes
Inspect kernel module load events confirming whether ksmbd is active on hosts that do not require it

Monitoring Recommendations

Forward kernel logs and SMB server telemetry to a centralized logging or SIEM platform for correlation against authentication events
Track ACL modification activity on SMB shares and alert on repeated failures or anomalous binary patterns in security descriptors
Establish baselines for SMB CREATE operations and flag spikes from individual authenticated users

How to Mitigate CVE-2026-31712

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits 151b1799, 90089584, 95e5aa3c, and d07b26f3
Disable the ksmbd kernel module on hosts that do not require an in-kernel SMB server using modprobe -r ksmbd
Restrict SMB share write and ACL-modification permissions to trusted authenticated users only

Patch Information

The fix tightens both ACE-walk loops in smb_check_perm_dacl() to require ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE, the smallest valid on-wire ACE layout. The patch also rejects ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES. Distribution-specific patched kernels are available through vendor channels. See the Kernel Git Commit 151b179, Kernel Git Commit 90089584, Kernel Git Commit 95e5aa3, and Kernel Git Commit d07b26f.

Workarounds

Replace ksmbd with the userspace Samba server where feasible until the kernel patch is applied
Limit SMB access to the network segments that strictly require it using firewall rules on TCP port 445
Revoke WRITE_DAC permissions from untrusted accounts to prevent crafted DACLs from being written

bash

# Verify ksmbd is loaded and remove it if not required
lsmod | grep ksmbd
sudo modprobe -r ksmbd

# Block SMB access from untrusted networks
sudo iptables -A INPUT -p tcp --dport 445 -s <trusted_subnet> -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP