CVE-2026-31707

What it actually does

This Linux kernel ksmbd flaw is an integer overflow and signedness validation bug in ipc_validate_msg(), the boundary where the kernel validates responses from the ksmbd userspace daemon. For several response types, attacker-controlled fields such as payload_sz and ngroups are added to fixed structure sizes using arithmetic that can wrap. In the LOGIN_REQUEST_EXT path, a negative ngroups value can be converted to a very large unsigned size during multiplication. If the wrapped calculated size matches the recorded message size, validation is bypassed and later code trusts the unvalidated original length, including memcpy paths for RPC payloads and kmemdup paths for group data. Successful exploitation can lead to kernel memory corruption, kernel crash, denial of service, and potentially disclosure of sensitive kernel memory. The CVSS vector indicates local access with low privileges and no user interaction, with high confidentiality and availability impact.

Why it matters to the business

Systems running the in-kernel Linux SMB server component, ksmbd, may be vulnerable to local privilege-boundary abuse that can destabilize the host or expose sensitive memory. Operationally, exploitation could interrupt SMB file sharing services, crash affected Linux servers, or contribute to a broader compromise if chained with another weakness. Although the EPSS score is currently low and there is no known KEV listing or reported ransomware use, kernel memory-corruption issues should be treated seriously on servers where ksmbd is enabled, especially file servers or appliances that expose SMB functionality. The issue has been public for 103 days, so organizations should prioritize verification and patching over waiting for evidence of active exploitation.

How an attack unfolds

An attacker first needs a position from which they can influence responses sent from the ksmbd userspace component to the kernel ksmbd module, which typically implies local low-privileged access, abuse of a local IPC path, compromise of the userspace ksmbd daemon, or a chain where remote SMB activity causes crafted daemon-side responses. The attacker constructs a ksmbd IPC response for one of the vulnerable message types, such as KSMBD_EVENT_RPC_REQUEST, KSMBD_EVENT_SHARE_CONFIG_REQUEST, or KSMBD_EVENT_LOGIN_REQUEST_EXT. They place malicious length values in payload_sz or ngroups so that ipc_validate_msg() calculates an expected message size that overflows or wraps to a seemingly valid value. Because the wrapped size matches the message size recorded for the IPC entry, the kernel accepts the response. Later, downstream kernel code uses the original untrusted length values rather than the wrapped validated size, causing oversized memcpy or kmemdup operations. Depending on heap layout and kernel hardening, the result may be a kernel panic, memory corruption, or exposure of sensitive kernel memory.

How to fix it

Upgrade affected Linux kernels to a vendor-supported release that includes the ksmbd fix for validating response sizes in ipc_validate_msg(). The corrected implementation uses overflow-safe arithmetic for RPC_REQUEST and SHARE_CONFIG_REQUEST response-size calculations and rejects LOGIN_REQUEST_EXT ngroups values outside the valid signed range of 0 through NGROUPS_MAX before multiplication. No exact fixed package versions were provided in the input, so use the relevant Linux distribution, appliance vendor, or kernel-stable advisory to identify the patched kernel build. If immediate patching is not possible, disable ksmbd if SMB serving is not required, unload or prevent loading of the ksmbd module where feasible, and use a mature user-space SMB server alternative if operationally acceptable. Limit local shell access on ksmbd hosts, restrict administrative access to ksmbd configuration and daemon processes, and ensure kernel hardening features and crash monitoring are enabled.

How to confirm the fix worked

Confirm whether the system is exposed by checking whether ksmbd is built, loaded, or active. Look for CONFIG_SMB_SERVER or ksmbd kernel module availability, loaded modules named ksmbd, active ksmbd services, and listening SMB services backed by ksmbd. Validate remediation by confirming the installed kernel package includes the patch that adds overflow-safe checks in ipc_validate_msg(), including check_add_overflow() handling for RPC and share-configuration responses and explicit ngroups validation for extended login responses. Where source or vendor patch metadata is available, search for the fix title or code changes in fs/smb/server/ksmbd_netlink.c or the corresponding ksmbd IPC validation implementation. After upgrade, reboot into the patched kernel and verify the running kernel version, not just the installed package version. If ksmbd is disabled as a mitigation, confirm the module is not loaded and the SMB service is not using ksmbd.

Typical attack path

1. Identify a Linux system with ksmbd enabled or the SMB server kernel module available.
2. Obtain local low-privileged execution or otherwise gain the ability to influence ksmbd userspace-to-kernel IPC responses.
3. Craft a malformed ksmbd IPC response using one of the vulnerable response types: KSMBD_EVENT_RPC_REQUEST, KSMBD_EVENT_SHARE_CONFIG_REQUEST, or KSMBD_EVENT_LOGIN_REQUEST_EXT.
4. Set payload_sz or ngroups to values that trigger unsigned wraparound or signed-to-unsigned conversion during message-size validation.
5. Send the malformed response through the ksmbd IPC path so ipc_validate_msg() accepts the message because the wrapped size appears valid.
6. Trigger downstream handling that trusts the original unvalidated length, causing an oversized copy or allocation in kernel context.
7. Use the resulting memory corruption or crash condition for denial of service, memory disclosure, or as part of a larger exploit chain.

How to detect it

There are no public, reliable exploit-specific indicators for this vulnerability. Detection should focus on signs of attempted or successful exploitation around ksmbd IPC handling and kernel memory corruption. Review kernel logs, system journal entries, crash dumps, netconsole output, and EDR telemetry for ksmbd-related kernel oops messages, BUG/WARNING entries, KASAN or slab allocator errors, oversized allocation failures, unexpected host reboots, or ksmbd service failures. Correlate these events with local user activity, recent changes to ksmbd userspace binaries or configuration, suspicious processes running with access to ksmbd IPC mechanisms, and SMB operations that occur immediately before a crash. If crash dumps are available, examine stacks involving ipc_validate_msg(), ksmbd IPC response handling, smb2pdu.c memcpy paths, ksmbd_alloc_user(), RPC request handling, share-configuration responses, or extended login handling. Because exploitation may produce only instability rather than a durable artifact, absence of logs does not prove absence of exploitation, especially if persistent kernel logs are not retained across reboots.

What your security team should do

• Inventory Linux systems that run ksmbd or have the ksmbd kernel module enabled, prioritizing SMB file servers, NAS-like appliances, and internet- or enterprise-exposed file-sharing hosts.
• Patch affected systems to a vendor kernel that contains the ipc_validate_msg() overflow validation fix, and reboot to ensure the patched kernel is active.
• If patching cannot be completed quickly, disable ksmbd or block use of the ksmbd module on systems where in-kernel SMB serving is not required.
• Restrict local access to ksmbd hosts because the vulnerability is assessed as locally exploitable with low privileges.
• Review daemon integrity and configuration permissions for ksmbd userspace components so untrusted users cannot influence daemon responses or IPC behavior.
• Monitor kernel logs for ksmbd-related crashes, memory-corruption warnings, KASAN reports, slab allocator errors, or unexpected reboots until all affected systems are remediated.
• Treat suspicious ksmbd crashes as potential security events and preserve kernel logs, crash dumps, process telemetry, and recent SMB activity for investigation.