{
  "cveId": "CVE-2026-31706",
  "url": "https://patchblox.com/security/cve/CVE-2026-31706",
  "summary": "CVE-2026-31706 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-31706, released May 15, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()  smb_inherit_dacl() trusts the on-disk num_aces value from the parent directory\u0027s DACL xattr and uses it to size a heap allocation:    aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...);  num_aces is a u16 read from le16_to_cpu(parent_pdacl-\u003Enum_aces) without checking that it is consistent with the declared pdacl_size. An authenticated client whose parent directory\u0027s security.NTACL is tampered (e.g. via offline xattr corruption or a concurrent path that bypasses parse_dacl()) can present num_aces = 65535 with minimal actual ACE data.  This causes a ~8 MB allocation (not kzalloc, so uninitialized) that the subsequent loop only partially populates, and may also overflow the three-way size_t multiply on 32-bit kernels.  Additionally, the ACE walk loop uses the weaker offsetof(struct smb_ace, access_req) minimum size check rather than the minimum valid on-wire ACE size, and does not reject ACEs whose declared size is below the minimum.  Reproduced on UML \u002B KASAN \u002B LOCKDEP against the real ksmbd code path. A legitimate mount.cifs client creates a parent directory over SMB (ksmbd writes a valid security.NTACL xattr), then the NTACL blob on the backing filesystem is rewritten to set num_aces = 0xFFFF while keeping the posix_acl_hash bytes intact so ksmbd_vfs_get_sd_xattr()\u0027s hash check still passes.  A subsequent SMB2 CREATE of a child under that parent drives smb2_open() into smb_inherit_dacl() (share has \u0022vfs objects = acl_xattr\u0022 set), which fails the page allocator:    WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof\u002B0x46c/0x9c0   Workqueue: ksmbd-io handle_ksmbd_work    __alloc_frozen_pages_noprof\u002B0x46c/0x9c0    ___kmalloc_large_node\u002B0x68/0x130    __kmalloc_large_node_noprof\u002B0x24/0x70    __kmalloc_noprof\u002B0x4c9/0x690    smb_inherit_dacl\u002B0x394/0x2430    smb2_open\u002B0x595d/0xabe0    handle_ksmbd_work\u002B0x3d3/0x1140  With the patch applied the added guard rejects the tampered value with -EINVAL before any large allocation runs, smb2_open() falls back to smb2_create_sd_buffer(), and the child is created with a default SD.  No warning, no splat.  Fix by:    1. Validating num_aces against pdacl_size using the same formula      applied in parse_dacl().    2. Replacing the raw kmalloc(sizeof * num_aces * 2) with      kmalloc_array(num_aces * 2, sizeof(...)) for overflow-safe      allocation.    3. Tightening the per-ACE loop guard to require the minimum valid      ACE size (offsetof(smb_ace, sid) \u002B CIFS_SID_BASE_SIZE) and      rejecting under-sized ACEs, matching the hardening in      smb_check_perm_dacl() and parse_dacl().  v1 -\u003E v2:   - Replace the synthetic test-module splat in the changelog with a     real-path UML \u002B KASAN reproduction driven through mount.cifs and     SMB2 CREATE; Namjae flagged the kcifs3_test_inherit_dacl_old name     in v1 since it does not exist in ksmbd.   - Drop the commit-hash citation from the code comment per Namjae\u0027s     review; keep the parse_dacl() pointer.",
  "published": "2026-05-01T14:16:20Z",
  "severity": "Important",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00493,
  "epssPercentile": 0.4258,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31706",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.85-1",
      "fix": "DEBIAN-CVE-2026-31706",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-31706",
      "released": "2026-05-15T16:01:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.0.3-1",
      "fix": "DEBIAN-CVE-2026-31706",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-31706",
      "released": "2026-05-15T16:01:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}