Skip to content
Heist/ feed
High

ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() smb_inherit_dacl() trusts the on-disk num_aces value from the parent directory's DACL xattr and uses it to size a heap allocation: aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...); num_aces is a u16 read from le16_to_cpu(parent_pdacl->num_aces) without checking that it is consistent with the declared pdacl_size. An authenticated client whose parent directory's security.NTACL is tampered (e.g. via offline xattr corruption or a concurrent path that bypasses parse_dacl()) can present num_aces = 65535 with minimal actual ACE data. This causes a ~8 MB allocation (not kzalloc, so uninitialized) that the subsequent loop only partially populates, and may also overflow the three-way size_t multiply on 32-bit kernels. Additionally, the ACE walk loop uses the weaker offsetof(struct smb_ace, access_req) minimum size check rather than the minimum valid on-wire ACE size, and does not reject ACEs whose declared size is below the minimum. Reproduced on UML + KASAN + LOCKDEP against the real ksmbd code path. A legitimate mount.cifs client creates a parent directory over SMB (ksmbd writes a valid security.NTACL xattr), then the NTACL blob on the backing filesystem is rewritten to set num_aces = 0xFFFF while keeping the posix_acl_hash bytes intact so ksmbd_vfs_get_sd_xattr()'s hash check still passes. A subsequent SMB2 CREATE of a child under that

Announced Source revision 1
Original source ↗

CVE-2026-31706

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-31706

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
        "lessThan": "ad7d18df7423c522ed9dc7e33bd5d54c66b1bc37",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
        "lessThan": "063a7409b0de46d7c770b65bb0338e6fdb3b1f0a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
        "lessThan": "3e5360b422dd741cb315654a191fa73869a37414",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
        "lessThan": "59c32abaaec9cdd6164811c7e864e72f7554b82d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
        "lessThan": "3e4e2ea2a781018ed5d75f969e3e5606beb66e48",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/smb/server/smbacl.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.15"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.15",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.84",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.25",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.0.2",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.*"
      },
      {
        "status": "unaffected",
        "version": "7.1",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/smb/server/smbacl.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-31706

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#46239 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement