CVE-2026-31708

What it actually does

This is an out-of-bounds read in the Linux kernel SMB/CIFS client. When a vulnerable system connects to a malicious SMB server, the server can return a malformed SMB2 QUERY_INFO response where the advertised OutputBufferLength is larger than the actual response buffer. The kernel client then copies the advertised length from the response buffer to userspace without first confirming that the flexible-array payload is fully contained in the received network buffer. This can disclose adjacent kernel heap memory to the calling userspace process and may also destabilize the kernel if the out-of-bounds read crosses into invalid memory.

Why it matters to the business

Systems that use the Linux kernel SMB/CIFS client to access SMB shares can be exposed if users, automation, backup jobs, file managers, or mount scripts connect to an attacker-controlled or compromised SMB server. Successful exploitation may leak sensitive kernel memory and can potentially cause system instability or denial of service. The issue is not currently listed in CISA KEV, has no reported ransomware use, and has a low EPSS score with no 30-day increase, but it still warrants remediation on Linux endpoints and servers that initiate SMB connections, especially where outbound SMB is allowed to untrusted networks.

How an attack unfolds

An attacker operates or compromises an SMB server and waits for a vulnerable Linux system to connect to it. The connection may be triggered by a user browsing or mounting a share, an application accessing a network path, or an automated process using CIFS/SMB storage. During an SMB2 QUERY_INFO operation, the malicious server sends a response that claims a large OutputBufferLength but includes a smaller actual response payload. The vulnerable kernel SMB client trusts the reported length for the userspace copy path and fails to verify that the requested number of bytes fits inside the received response iovec. As a result, copy_to_user() reads beyond the SMB response buffer and returns adjacent kernel heap bytes to the userspace caller. Depending on memory layout and access boundaries, the same condition may also contribute to kernel faults or system instability.

How to fix it

Upgrade the Linux kernel to a vendor release that includes the SMB client fix for the smb2_ioctl_query_info() QUERY_INFO response-copy bounds check. Because fixed versions vary by distribution and kernel branch, use the patched kernel packages from the relevant Linux distribution or appliance vendor and reboot into the updated kernel. Where immediate patching is not possible, reduce exposure by disabling unnecessary CIFS/SMB client usage, blocking outbound SMB traffic to untrusted networks, preventing mounts of untrusted SMB shares, restricting use of mount.cifs to trusted administrators and service accounts, and enforcing egress controls for TCP/445 and legacy TCP/139. Treat SMB servers outside managed infrastructure as untrusted until patched clients are deployed.

How to confirm the fix worked

Confirm that systems are running a kernel build containing the upstream or vendor backport for the SMB client QUERY_INFO bounds check. Validate with distribution package metadata, vendor advisories, changelogs, and the active booted kernel version rather than only checking installed packages. After remediation, reboot systems and verify the running kernel with uname -r or equivalent inventory tooling. Review whether CIFS/SMB client mounts are still required and confirm outbound SMB access is limited to approved servers. For exposure validation, inventory active and persistent CIFS mounts, systemd mount units, autofs maps, fstab entries, container host mounts, and file-management workflows that initiate SMB connections.

Typical attack path

1. Attacker sets up or compromises an SMB/SMB2/SMB3 server reachable by target Linux systems.
2. Attacker entices a user, application, mount unit, backup job, or file-management workflow to connect to the malicious SMB share.
3. The vulnerable Linux SMB/CIFS client negotiates the SMB session and performs a QUERY_INFO-related operation.
4. The malicious server returns a malformed QUERY_INFO response with OutputBufferLength larger than the actual buffer payload.
5. The kernel SMB client copies the advertised number of bytes from the response buffer to userspace without sufficient bounds validation.
6. Adjacent kernel heap contents may be disclosed to the local process that initiated the SMB operation, and the host may experience instability if the read crosses unsafe memory boundaries.

How to detect it

There are no public, CVE-specific exploitation indicators or known threat actor campaigns for this issue. Detection should focus on evidence that a Linux host connected to an untrusted SMB server and then experienced unusual CIFS client behavior, kernel warnings, crashes, or suspicious mount activity. Useful log sources include kernel logs, journald, syslog, auditd, EDR process telemetry, shell history where available, systemd mount logs, autofs logs, firewall logs, DNS logs, proxy or network flow records, and packet captures for SMB traffic. Hunt for executions of mount.cifs or mount operations to unfamiliar hosts, new or modified CIFS entries in /etc/fstab or systemd mount units, outbound TCP/445 connections to internet or non-approved addresses, and kernel messages containing CIFS VFS errors around the same time. If forensic artifacts are available, correlate the SMB server IP, the process or user that initiated the mount, the mounted UNC path, and any subsequent kernel oops, panic, or abnormal reboot. Because the primitive leaks memory to the local userspace caller, host telemetry may show little beyond the SMB connection and mount/query operation; absence of a crash does not rule out exploitation.

• mount.cifs
• /sbin/mount.cifs
• /usr/sbin/mount.cifs
• type=cifs
• cifs.ko
• CIFS VFS:
• SMB2
• QUERY_INFO
• smb2_ioctl_query_info
• tcp/445
• dport=445
• /etc/fstab
• .mount
• autofs
• kernel: CIFS VFS:
• kernel: BUG:
• kernel: Oops:
• kernel panic

What your security team should do

• Prioritize patching Linux systems that initiate SMB/CIFS connections, especially endpoints, jump hosts, backup servers, file transfer systems, and servers with automated SMB mounts.
• Verify that the active running kernel, not just the installed package set, includes the vendor fix; schedule reboots where required.
• Restrict outbound SMB traffic on TCP/445 and TCP/139 to approved internal SMB servers; block SMB to the internet and untrusted networks.
• Inventory /etc/fstab, systemd mount units, autofs configuration, scripts, and backup jobs for CIFS/SMB mounts and remove or harden unnecessary connections.
• Monitor for Linux hosts connecting to unfamiliar SMB servers, especially shortly before kernel warnings, CIFS errors, or host instability.
• Limit permission to run mount.cifs or create CIFS mounts to trusted administrators and controlled automation.
• If suspicious SMB activity is found, preserve kernel logs, audit logs, process execution telemetry, mount history, and network flow data before rebooting or reimaging affected systems.