CVE-2026-31706

What it actually does

The vulnerability is an improper input validation flaw in the Linux kernel ksmbd SMB server. ksmbd trusts the num_aces field from a parent directory's security.NTACL extended attribute when inheriting a discretionary access control list for a newly created child object. If that on-disk ACL metadata is malformed or tampered with, ksmbd can calculate an excessive allocation size, potentially trigger large heap allocations, use partially initialized memory during ACL processing, or overflow allocation arithmetic on 32-bit kernels. The vulnerable path is reached during SMB2 CREATE handling when ksmbd attempts to inherit the parent directory DACL. Impact can include kernel memory pressure, kernel warnings or crashes, denial of service, and potentially broader confidentiality or integrity consequences consistent with kernel memory corruption risk.

Why it matters to the business

Systems using the in-kernel ksmbd SMB server can be destabilized by a low-privileged authenticated SMB user if malicious or corrupted NTACL metadata is present on a shared backing filesystem. A successful attack could interrupt file sharing services, crash the host, or create risk of unauthorized access or data modification. Although this issue is not listed in CISA KEV, has no known ransomware association, and currently has low EPSS with no observed upward trend, the high CVSS score and kernel-level impact make it important for organizations exposing ksmbd-based file shares, especially where SMB accounts can create directories or where filesystem extended attributes can be modified through other administrative, backup, migration, or offline maintenance paths.

How an attack unfolds

An attacker first needs authenticated access to an SMB share served by Linux ksmbd, or another way to cause or influence malformed security.NTACL extended attributes on the backing filesystem. The attacker prepares a parent directory whose NTACL extended attribute contains an inconsistent DACL: the num_aces field advertises a very large ACE count, such as 65535, while the actual ACL data remains small enough to pass weaker checks. When the attacker then creates a child file or directory under that parent over SMB, ksmbd enters the SMB2 CREATE path and calls the DACL inheritance routine. The vulnerable code trusts the attacker-influenced num_aces value, attempts to allocate memory based on that count, and walks ACE records using insufficient size validation. This can trigger a large kernel allocation, allocation failure, kernel warning, crash, or unsafe memory behavior before the request completes. Patched kernels reject the malformed ACL metadata before the large allocation and fall back to creating a default security descriptor.

How to fix it

Upgrade the Linux kernel to a version that includes the ksmbd fix for validating DACL num_aces against pdacl_size, using overflow-safe allocation, and rejecting undersized ACE records. No exact fixed package versions were provided in the input, so use the fixed kernel builds supplied by the relevant Linux distribution or vendor advisory. If immediate patching is not possible, reduce exposure by disabling ksmbd where not required, restricting SMB access to trusted users and networks, disabling or limiting shares that rely on NTACL/xattr-based ACL inheritance where operationally feasible, and preventing untrusted users or maintenance workflows from modifying security.NTACL extended attributes on backing filesystems. Prefer the mature Samba userspace server where ksmbd is not specifically required, subject to compatibility testing.

How to confirm the fix worked

Confirm that affected systems are no longer running a vulnerable kernel build by checking the installed kernel package against the distribution's advisory or changelog for the ksmbd DACL inheritance hardening. Verify whether ksmbd is enabled by checking loaded modules, active services, and listening SMB ports. Where safe and authorized, validate behavior in a non-production test environment by creating a ksmbd share with NTACL inheritance and confirming malformed parent security.NTACL metadata is rejected without kernel page-allocation warnings or ksmbd crashes. Review kernel logs after validation for absence of call traces involving smb_inherit_dacl(), smb2_open(), handle_ksmbd_work(), kmalloc, or page_alloc warnings. Also inspect high-risk shares for unexpected or malformed security.NTACL extended attributes, especially on parent directories used heavily for file creation.

Typical attack path

1. Identify or obtain authenticated SMB access to a Linux server using the in-kernel ksmbd service.
2. Find or create a parent directory on a ksmbd share where NTACL metadata is used for access-control inheritance.
3. Tamper with or introduce malformed security.NTACL extended attribute data so the DACL num_aces value is inconsistent with the actual DACL size.
4. Set num_aces to an excessive value while preserving enough surrounding metadata for ksmbd to accept or process the security descriptor.
5. Issue an SMB2 CREATE operation for a child file or directory under the malformed parent directory.
6. Trigger smb_inherit_dacl() during ACL inheritance, causing excessive allocation, allocation arithmetic overflow on some platforms, or invalid ACE walking.
7. Cause kernel warnings, memory pressure, ksmbd worker failure, service disruption, or potentially kernel crash or memory-corruption side effects.

How to detect it

To determine whether exploitation may already have occurred, review kernel logs, system journals, crash dumps, and SMB service logs for ksmbd failures that coincide with authenticated SMB create operations. Focus on warnings or call traces involving smb_inherit_dacl(), smb2_open(), handle_ksmbd_work, kmalloc, page allocation failures, or KASAN/LOCKDEP reports. Check whether affected hosts experienced unexplained SMB outages, kernel panics, soft lockups, OOM events, or repeated ksmbd worker failures. Correlate these events with SMB authentication logs and file-creation activity by low-privileged users. For forensic review, inspect directories on ksmbd-backed shares for abnormal security.NTACL extended attributes, especially values where the declared ACE count is implausibly high or inconsistent with the xattr length. If threat hunting at scale, prioritize systems where ksmbd is enabled and where users or automation can modify extended attributes directly outside the normal ksmbd ACL parsing path.

• security.NTACL
• smb_inherit_dacl
• smb2_open
• handle_ksmbd_work
• ksmbd-io
• WARNING: mm/page_alloc.c
• __alloc_frozen_pages_noprof
• ___kmalloc_large_node
• __kmalloc_large_node_noprof
• __kmalloc_noprof
• kmalloc(sizeof(struct smb_ace) * num_aces * 2
• num_aces = 65535
• num_aces = 0xFFFF
• KASAN
• LOCKDEP
• smb2_create_sd_buffer
• ksmbd_vfs_get_sd_xattr
• acl_xattr

What your security team should do

• Prioritize patching Linux systems that run ksmbd and expose SMB shares to non-administrative or broadly distributed authenticated users.
• Inventory hosts with ksmbd enabled, including appliances, file servers, NAS-like Linux deployments, and custom kernels.
• Restrict SMB access to trusted networks and users until patched; do not expose ksmbd directly to untrusted networks.
• Audit administrative, backup, migration, and filesystem maintenance tooling that can modify extended attributes on SMB backing filesystems.
• Monitor kernel logs for ksmbd call traces, page allocation warnings, and crashes involving smb_inherit_dacl or SMB2 CREATE operations.
• Review file shares for suspicious or malformed security.NTACL extended attributes on directories if exploitation or corruption is suspected.
• If ksmbd is not business-critical, disable it or migrate the service to a supported userspace SMB implementation after compatibility testing.
• Treat any kernel crash or repeated ksmbd worker failure on an affected host as a potential security incident until logs and filesystem metadata are reviewed.