CVE-2026-31433

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound request consists of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) and the first command consumes nearly the entire max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16() with PATH_MAX, causing out-of-bounds write beyond the response buffer. In get_file_all_info(), there was a missing validation check for the client-provided OutputBufferLength before copying the filename into FileName field of the smb2_file_all_info structure. If the filename length exceeds the available buffer space, it could lead to potential buffer overflows or memory corruption during smbConvertToUTF16 conversion. This calculating the actual free buffer size using smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is insufficient and updating smbConvertToUTF16 to use the actual filename length (clamped by PATH_MAX) to ensure a safe copy operation.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Linux Kernel (ksmbd enabled, versions prior to patch)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import socket
import struct

# This is a conceptual PoC to demonstrate the compound request structure.
# Actual exploitation requires precise packet crafting and kernel interaction.

def create_compound_request():
    # SMB Header placeholder
    header = b"\x00\x00\x00\x00" # ... SMB2 Header ...
    
    # Command 1: QUERY_DIRECTORY (Designed to consume max_trans_size)
    # This payload should be sized to leave very little room for the next command
    query_dir_payload = b"A" * 1024 # Adjust size based on target max_trans_size
    
    # Command 2: QUERY_INFO (FILE_ALL_INFORMATION)
    # This triggers the vulnerable get_file_all_info()
    query_info_cmd = struct.pack('<I', 1) # FileAllInformation
    
    # Combine into compound request
    # The vulnerability triggers when processing the second command
    # due to lack of OutputBufferLength check against remaining space.
    return header + query_dir_payload + query_info_cmd

# Note: This is for educational analysis only.
# Real-world testing requires a vulnerable environment and deep protocol knowledge.
print("PoC structure generated for analysis.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31433
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31433
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31433/
[4] VulDB https://vuldb.com/cve/CVE-2026-31433
[5] https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe
[6] https://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7
[7] https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652c
[8] https://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5
[9] https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0
[10] https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5d
[11] https://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31433", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-22T09:16:21.573", "lastModified": "2026-04-27T14:16:38.190", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial OOB in get_file_all_info() for compound requests\n\nWhen a compound request consists of QUERY_DIRECTORY + QUERY_INFO\n(FILE_ALL_INFORMATION) and the first command consumes nearly the entire\nmax_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()\nwith PATH_MAX, causing out-of-bounds write beyond the response buffer.\nIn get_file_all_info(), there was a missing validation check for\nthe client-provided OutputBufferLength before copying the filename into\nFileName field of the smb2_file_all_info structure.\nIf the filename length exceeds the available buffer space, it could lead to\npotential buffer overflows or memory corruption during smbConvertToUTF16\nconversion. This calculating the actual free buffer size using\nsmb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is\ninsufficient and updating smbConvertToUTF16 to use the actual filename\nlength (clamped by PATH_MAX) to ensure a safe copy operation."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "references": [{"url": "https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}