CVE-2026-31478

The vulnerability resides in the ksmbd kernel module, which implements an SMB server. After commit e2b76ab8b5c9 introduced dynamic iov array management for response buffers, the function smb2_calc_max_out_buf_len() was updated to expect the offset of the Buffer field in the response structure as its second argument. However, several call sites continued to pass hardcoded header length values instead of the correct offsetof() value [1]. This discrepancy leads to incorrect buffer size calculations.

An unauthenticated remote attacker can exploit this by sending specially crafted SMB2 compound requests. The miscalculated buffer size can cause the kernel to write beyond the allocated buffer, resulting in a heap-based buffer overflow. No authentication is required, and the attack can be launched over the network.

Successful exploitation could allow an attacker to execute arbitrary code in the context of the kernel, leading to full system compromise. Given the critical CVSS score of 9.8, this vulnerability poses a severe risk to systems running the affected ksmbd versions.

The Linux kernel stable tree has released patches that replace the hardcoded values with the correct offsetof() calls [1][2][3][4]. Users are strongly advised to update their kernels to the latest stable release. No workaround is available; updating is the only mitigation.