CVE-2026-31704

What it actually does

This is a Linux kernel memory-corruption flaw in the ksmbd in-kernel SMB server ACL conversion logic. While constructing NT-style discretionary access control lists from POSIX ACL data, ksmbd accumulates access-control-entry sizes in 16-bit variables. A file with a large number of ACL entries can cause the accumulated size to wrap past 65,535 bytes, making subsequent pointer arithmetic target an earlier part of the same buffer. Later writes can overwrite previously written ACL entries and store a truncated DACL size. The most likely security impact is kernel memory corruption leading to a local denial of service or kernel crash; the assigned vector indicates local access with low privileges is required and does not indicate confidentiality or integrity impact.

Why it matters to the business

Systems using vulnerable Linux kernels with ksmbd enabled may be susceptible to crashes triggered by a low-privileged local user who can create or manipulate files with unusually large ACLs. The main operational risk is service disruption: the SMB file-sharing service or the entire host may become unavailable if the kernel faults. Current public exploitation signals are low: EPSS is approximately 0.00117, flat over 30 days, the issue is not in the CISA KEV catalog, is not known to be used in ransomware campaigns, and no mature public exploit is indicated. Even so, kernel-level denial-of-service bugs should be prioritized on shared file servers, multi-user systems, and appliances that expose ksmbd-backed SMB shares.

How an attack unfolds

An attacker first needs low-privileged local access to a system running a vulnerable Linux kernel and a way to create or modify filesystem ACLs that ksmbd later converts into SMB/NT ACL format. The attacker prepares a file or directory with an unusually large number of POSIX ACL entries so that the DACL size calculation exceeds the maximum value representable by a 16-bit accumulator. When ksmbd processes the ACL, the size counter wraps and subsequent ACE writes are calculated relative to an incorrect offset inside the ACL buffer. That can corrupt the generated security descriptor data and may trigger a kernel fault, warning, or crash. The practical outcome is usually denial of service rather than reliable code execution based on the available description and CVSS attributes.

How to fix it

Upgrade to a Linux kernel version that includes the ksmbd fix using check_add_overflow() in the DACL size accumulation paths in smbacl.c. No exact fixed package versions were provided in the input, so remediation should be performed through the relevant Linux distribution kernel advisories and vendor-supported kernel packages. Where immediate patching is not possible, reduce exposure by disabling ksmbd if it is not required, replacing it with a supported user-space SMB service where appropriate, restricting local shell access, limiting who can create or modify extended ACLs on ksmbd-exported filesystems, and monitoring for abnormal ACL manipulation. Because this is in kernel code, restarting only user-space services may not be sufficient after suspected triggering; a patched kernel normally requires rebooting into the fixed version.

How to confirm the fix worked

Confirm that the running kernel package includes the vendor fix for CVE-2026-31704 or the upstream ksmbd change that adds overflow checks during DACL size accumulation. Validate both the installed kernel and the actively running kernel, since patched packages do not protect the host until booted. Check whether ksmbd is loaded or enabled using service configuration, loaded modules, and kernel logs. If ksmbd is not used, verify it remains disabled after reboot. Where safe in a test environment, confirm that excessive ACL-entry scenarios are rejected or fail safely rather than producing kernel warnings, memory corruption, or crashes. Review distribution advisories because kernel backports may carry the fix without changing to an obvious upstream version number.

Typical attack path

1. Obtain low-privileged local access to a vulnerable Linux system.
2. Confirm that ksmbd is present, enabled, or reachable indirectly through SMB file-sharing workflows.
3. Create or select a file or directory on a filesystem where the attacker can manipulate POSIX ACLs.
4. Add a very large number of ACL entries so the generated SMB DACL size calculation exceeds 65,535 bytes.
5. Trigger ksmbd to translate the POSIX ACL into an NT-style DACL, such as by SMB metadata access or ACL retrieval.
6. Cause the 16-bit DACL size accumulator to wrap, resulting in incorrect pointer arithmetic and overwriting of earlier ACE data.
7. Induce kernel memory corruption that may crash ksmbd-related kernel execution paths or the host, causing denial of service.

How to detect it

To assess whether this was already triggered, review kernel logs, system journals, crash dumps, and audit records for ksmbd-related crashes or warnings around the time of unusual ACL activity. Useful sources include dmesg output, /var/log/kern.log, /var/log/messages, systemd journal entries for the kernel, kdump/vmcore artifacts, auditd logs for chmod/setxattr/acl-related operations, shell history or process accounting showing setfacl/chacl usage, and SMB service telemetry if ksmbd logging is enabled. Look for kernel Oops, panic, slab corruption, KASAN, UBSAN, or general protection fault messages involving ksmbd, smbacl.c, DACL, NTACL, POSIX ACL conversion, or security descriptor processing. Since no public exploit artifacts or actor-specific indicators are provided, detection should focus on behavioral evidence: repeated ACL expansion, files with very large ACLs, ksmbd crashes after ACL retrieval or metadata access, and unexplained host reboots on systems running ksmbd.

• ksmbd
• smbacl.c
• set_posix_acl_entries_dacl
• set_ntacl_dacl
• posix_acl
• ntacl
• DACL
• security descriptor
• Oops:
• kernel BUG
• general protection fault
• KASAN:
• UBSAN:
• slab-out-of-bounds
• use-after-free
• kernel panic
• ksmbd:
• setfacl
• chacl
• /var/log/kern.log
• /var/log/messages
• /proc/fs/cifsd
• ksmbd.mountd

What your security team should do

• Prioritize patching Linux file servers, multi-user systems, NAS-like appliances, and hosts where ksmbd is enabled or where untrusted local users can manipulate ACLs.
• Identify systems with ksmbd loaded or configured and confirm whether they run a vendor-fixed kernel.
• If ksmbd is not operationally required, disable it and prevent it from loading automatically.
• Restrict local account access and ACL-management permissions on shared filesystems until patching is complete.
• Monitor kernel logs for ksmbd-related faults, warnings, Oops messages, panics, or crashes involving ACL/security descriptor handling.
• Correlate suspicious events with bursts of setfacl/chacl activity or creation of files/directories with unusually large ACLs.
• Because EPSS is low, not KEV-listed, and no exploit maturity is reported, handle as normal kernel patch hygiene unless ksmbd exposure or multi-user access materially increases local denial-of-service risk.