CVE-2026-31433
published 2026-04-22CVE-2026-31433: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.60%
44.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix potencial OOB in get_file_all_info() for compound requests
When a compound request consists of QUERY_DIRECTORY + QUERY_INFO
(FILE_ALL_INFORMATION) and the first command consumes nearly the entire
max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()
with PATH_MAX, causing out-of-bounds write beyond the response buffer.
In get_file_all_info(), there was a missing validation check for
the client-provided OutputBufferLength before copying the filename into
FileName field of the smb2_file_all_info structure.
If the filename length exceeds the available buffer space, it could lead to
potential buffer overflows or memory corruption during smbConvertToUTF16
conversion. This calculating the actual free buffer size using
smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is
insufficient and updating smbConvertToUTF16 to use the actual filename
length (clamped by PATH_MAX) to ensure a safe copy operation.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 5.15.145 < 5.15.203 | 5.15.203 |
| linux | linux | >= 6.1.71 < 6.1.168 | 6.1.168 |
| linux | linux | >= 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 < 4cca3eff2099b18672934a39cee70aed835d652c | 4cca3eff2099b18672934a39cee70aed835d652c |
| linux | linux | >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe | 358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe |
| linux | linux | >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 7aec5a769d2356cbf344d85bcfd36de592ac96a5 | 7aec5a769d2356cbf344d85bcfd36de592ac96a5 |
| linux | linux | >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < b0cd9725fe2bcc9f37d096b132318a9060373f5d | b0cd9725fe2bcc9f37d096b132318a9060373f5d |
| linux | linux | >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 9d7032851d6f5adbe2739601ca456c0ad3b422f0 | 9d7032851d6f5adbe2739601ca456c0ad3b422f0 |
| linux | linux | >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < beef2634f81f1c086208191f7228bce1d366493d | beef2634f81f1c086208191f7228bce1d366493d |
| linux | linux | >= f2283680a80571ca82d710bc6ecd8f8beac67d63 < 3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7 | 3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.15.145 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 6.1.71 < 6.1.168 | 6.1.168 |
| linux | linux_kernel | >= 6.13 < 6.18.21 | 6.18.21 |
| linux | linux_kernel | >= 6.19 < 6.19.11 | 6.19.11 |
| linux | linux_kernel | >= 6.6 < 6.6.131 | 6.6.131 |
| linux | linux_kernel | >= 6.7 < 6.12.80 | 6.12.80 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.19.10 ksmbd get_file_all_info buffer overflow (WID-SEC-2026-1232)
vuldb·2026-05-23·CVSS 8.8
CVE-2026-31433 [HIGH] Linux Kernel up to 6.19.10 ksmbd get_file_all_info buffer overflow (WID-SEC-2026-1232)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.19.10. Affected by this vulnerability is the function get_file_all_info of the component ksmbd. The manipulation leads to buffer overflow.
This vulnerability is uniquely identified as CVE-2026-31433. The attack can only be initiated within the local network. No exploit exists.
You should upgrade the affected component.
GHSA
GHSA-32xq-pcg8-hc33: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix potencial OOB in get_file_all_info() for compound requests
When a com
ghsa_unreviewed·2026-04-22
CVE-2026-31433 GHSA-32xq-pcg8-hc33: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix potencial OOB in get_file_all_info() for compound requests
When a com
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix potencial OOB in get_file_all_info() for compound requests
When a compound request consists of QUERY_DIRECTORY + QUERY_INFO
(FILE_ALL_INFORMATION) and the first command consumes nearly the entire
max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()
with PATH_MAX, causing out-of-bounds write beyond the response buffer.
In get_file_all_info(), there was a missing validation check for
the client-provided OutputBufferLength before copying the filename into
FileName field of the smb2_file_all_info structure.
If the filename length exceeds the available buffer space, it could lead to
potential buffer overflows or memory corruption during smbConvertToUTF16
conversion. This calculating the actual
Red Hat
kernel: ksmbd: fix potencial OOB in get_file_all_info() for compound requests
vendor_redhat·2026-04-22
CVE-2026-31433 CWE-120 kernel: ksmbd: fix potencial OOB in get_file_all_info() for compound requests
kernel: ksmbd: fix potencial OOB in get_file_all_info() for compound requests
A flaw was found in the ksmbd module of the Linux kernel. A remote attacker can exploit this vulnerability by sending a specially crafted compound request, specifically a combination of QUERY_DIRECTORY and QUERY_INFO. Due to a missing validation check for the client-provided output buffer length, an out-of-bounds write can occur when processing filenames. This can lead to memory corruption, potentially causing a denial of service or other unpredictable system behavior.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fehttps://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652chttps://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5dhttps://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d
2026-04-22
Published