CVE-2026-31611

Root

Cause In the Linux ksmbd server, the parse_dacl() function compares each ACE's SID against a known prefix (S-1-5-88-3) to match NFS-style special SIDs). When a match is found, the third sub-authority (sub_auth[2]) is read directly and interpreted as the file's POSIX permission bits. However, the comparison logic only checks the first two sub-authorities. If a client supplies a SID with only two sub-authorities (e.g., S-1-5-88-3 with num_subauth=2), the code still attempts to read sub_auth[2] — reading 4 bytes beyond the actual ACL data [1][2][3].

Attack

Surface An attacker must be exploited by a remote, unauthenticated client that can establish an SMB session with the ksmbd server. The attacker crafts a security descriptor containing an ACE with a specially tailored SID (having only 2 sub-authorities) and places that ACE at the very end of the descriptor. When ksmbd processes the security descriptor parsing, the out-of-bounds read occurs past the end of the ACL [Description][4].

Impact

The four out-of-bounds bytes are masked to a 9-bit value and applied as the file's POSIX mode bits. While the exact value is uncontrolled, this can arbitrarily change the permissions of files exposed via ksmbd, potentially allowing unauthorized access or privilege escalation. The attack corrupts the intended file permissions in a way that depends on the memory layout adjacent to the ACL.

Mitigation

The fix, merged into the stable kernel branches referenced by the kernel.org commits, adds a check that the SID truly has at least three sub-authorities before attempting to read sub_auth[2]. This prevents the OOB read entirely. Users should update to a kernel version that patched kernel version.