CVE-2026-31709

Vulnerability

The vulnerability exists in the Linux kernel's CIFS (SMB) client, specifically in the security descriptor handling during chmod/chown operations. The functions build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and reconstruct the ACL. The original fix only validated that the struct smb_acl header fits within the buffer, but did not verify the integrity of the individual ACEs within the DACL body.

Exploitation

A malicious SMB server can craft a response with a truncated DACL that has a valid header but claims more ACEs than actually present. When the client processes a chmod or chown request, it calls replace_sids_and_copy_aces() or set_chmod_dacl(), which iterate over pdacl->num_aces without bounds checking. This allows the server to drive out-of-bounds reads or writes when comparing or copying attacker-controlled ACE data.

Impact

An attacker who controls an SMB server (or can perform a man-in-the-middle attack) can exploit this to corrupt kernel memory, potentially leading to privilege escalation or denial of service. The vulnerability is rated High with CVSS 8.8.

Mitigation

The fix, introduced in kernel commit 8e47d297e7cf, factors DACL validation into a new helper function validate_dacl(). This function now checks each ACE against the DACL bounds before the rewrite paths. The same validator is reused in parse_dacl() for consistency. Users should apply the patch from the stable kernel tree [1].