CVE-2026-31712

What it actually does

CVE-2026-31712 is an out-of-bounds read in the Linux kernel ksmbd SMB server permission-checking path. When ksmbd walks a discretionary access control list (DACL), it validates that an ACE fits within the remaining buffer but fails to require that the ACE is large enough to contain the fields later dereferenced. An authenticated SMB user who can set an ACL on a file they control can store a malformed ACE with a too-small declared size. A later SMB CREATE/open operation against that file causes the kernel to read beyond the ACE while evaluating access_req and SID fields. The issue is not pre-authentication and the out-of-bounds data is not directly returned to the attacker, but it can trigger kernel memory-safety faults, KASAN reports, permission-evaluation anomalies, kernel instability, or denial of service of the host running ksmbd.

Why it matters to the business

Organizations using the in-kernel Linux SMB server may be exposed to authenticated remote attacks that can destabilize file-serving hosts, interrupt SMB file access, and potentially contribute to broader kernel compromise scenarios. The practical risk is lower than a pre-authentication remote code execution flaw because exploitation requires a valid SMB account with permission to set an ACL on a file, and current exploit maturity is reported as none with low EPSS and no known KEV or ransomware use. However, the CVSS severity is high, the affected component runs in kernel context, and SMB file servers are often operationally important, so patching should be prioritized for systems where ksmbd is enabled or exposed to untrusted users.

How an attack unfolds

An attacker first obtains valid SMB credentials for a server using Linux ksmbd and identifies a location where that account can create or own a file and modify its ACL. The attacker writes a crafted security descriptor containing a malformed ACE whose declared size is smaller than the minimum valid ACE layout. ksmbd stores or later processes this DACL. When the attacker, or another client, performs a CREATE/open operation on the affected file, ksmbd invokes smb_check_perm_dacl() to evaluate permissions. Because the vulnerable code accepts the undersized ACE, it reads access_req and SID data beyond the declared ACE boundary. Depending on surrounding kernel memory layout and runtime hardening, this may produce a KASAN out-of-bounds report, kernel oops, service disruption, or abnormal permission-check behavior. There are no currently reported named threat actors, KEV listing, or public mature exploit associated with this vulnerability, but authenticated SMB abuse is a realistic path in environments where many users can write files and set ACLs.

How to fix it

Apply a vendor kernel update that includes the ksmbd fix requiring a minimum valid ACE size in smb_check_perm_dacl() and rejecting SID sub-authority counts above SID_MAX_SUB_AUTHORITIES. No exact fixed package versions were provided, so use the fixed kernel builds from the relevant Linux distribution or upstream stable kernel advisories. Where immediate patching is not possible, reduce exposure by disabling ksmbd if it is not required, unloading or blocking the ksmbd module where feasible, restricting TCP/445 access to trusted networks, limiting SMB accounts that can create files or modify ACLs, and preferring a patched user-space SMB service if ksmbd is not operationally required. These mitigations reduce reachability but do not correct the kernel bug.

How to confirm the fix worked

Confirm whether ksmbd is enabled on Linux SMB servers, then verify the running kernel package includes the upstream ksmbd DACL bounds-checking patch or the distribution advisory that fixes this CVE. Validate that the running kernel has been rebooted into the patched version, not merely that a package is installed. On source-based or custom kernels, inspect fs/smb/server/smbacl.c or the equivalent ksmbd ACL handling code for checks that require the minimum ACE layout size before reading access_req or SID fields and reject excessive sid.num_subauth values. In a controlled test environment, malformed ACL regression tests should be rejected without kernel warnings, KASAN reports, oops messages, or SMB service disruption. Production validation should avoid exploit-style testing and instead rely on package inventory, kernel version verification, and absence of vulnerable ksmbd code paths.

Typical attack path

1. Authenticate to an SMB share served by Linux ksmbd using valid credentials.
2. Create or identify a file for which the account can set or modify the DACL.
3. Apply a crafted security descriptor containing an ACE with an undersized ace->size value and malformed SID-related fields.
4. Trigger a subsequent SMB CREATE/open request against the file so ksmbd evaluates the stored DACL.
5. Cause smb_check_perm_dacl() to read beyond the malformed ACE while processing access_req or SID data.
6. Observe operational effects such as failed SMB operations, kernel warnings, KASAN findings, an oops, or host instability.

How to detect it

Look for evidence in kernel and system logs rather than web-style access logs, because exploitation occurs inside the ksmbd kernel path. Relevant sources include dmesg, journald, /var/log/kern.log, /var/log/messages, syslog, crash dumps, kdump/vmcore artifacts, EDR kernel telemetry, and any SMB audit logs showing ACL or security-descriptor changes followed by file CREATE/open activity. Investigate KASAN out-of-bounds reports, kernel oops or BUG messages, general protection faults, panics, or repeated ksmbd worker failures that reference smb_check_perm_dacl(), compare_sids(), smb_ace, DACL, SID parsing, or fs/smb/server/smbacl.c. Correlate these events with authenticated SMB users who recently created files or changed ACLs/security descriptors on the same share. Because the out-of-bounds read is not directly reflected to the client, absence of obvious data exfiltration indicators does not rule out attempted exploitation. If crash dumps are available, inspect stack traces for ksmbd permission-checking functions and preserve the file metadata and ACL/security descriptor associated with the last accessed SMB object before the crash.

• smb_check_perm_dacl
• compare_sids
• fs/smb/server/smbacl.c
• ksmbd
• KASAN: slab-out-of-bounds
• KASAN: out-of-bounds
• BUG: KASAN
• general protection fault
• kernel BUG
• Oops:
• panic: Fatal exception
• smb_ace
• ace->size
• access_req
• SID_MAX_SUB_AUTHORITIES
• CIFS_SID_BASE_SIZE
• DACL

What your security team should do

• Inventory Linux hosts exposing SMB on TCP/445 and determine which use kernel ksmbd rather than only user-space Samba smbd.
• Prioritize patching ksmbd-enabled file servers, especially those reachable by many authenticated users or by less-trusted network segments.
• Reboot after kernel updates and verify the active running kernel is the fixed version.
• Disable ksmbd on systems that do not explicitly require the in-kernel SMB server.
• Restrict SMB access with host firewalls, network ACLs, or segmentation so only trusted clients can reach ksmbd.
• Review share permissions and reduce the number of users allowed to create files and set custom ACLs.
• Monitor kernel logs for KASAN, oops, BUG, general protection fault, or ksmbd messages around SMB file-open and ACL operations.
• Treat any unexplained ksmbd-related kernel crash or KASAN out-of-bounds report as a potential security event and preserve logs for forensic review.
• Because EPSS is currently low, no KEV listing exists, and no mature exploit is reported, schedule remediation according to internal high-severity kernel exposure policy rather than emergency internet-wide exploitation response, unless ksmbd is exposed to untrusted authenticated users.