CVE-2026-31612
published 2026-04-24CVE-2026-31612: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate EaNameLength in smb2_get_ea() smb2_get_ea() reads ea_req->EaNameLength from…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.41%
33.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate EaNameLength in smb2_get_ea()
smb2_get_ea() reads ea_req->EaNameLength from the client request and
passes it directly to strncmp() as the comparison length without
verifying that the length of the name really is the size of the input
buffer received.
Fix this up by properly checking the size of the name based on the value
received and the overall size of the request, to prevent a later
strncmp() call to use the length as a "trusted" size of the buffer.
Without this check, uninitialized heap values might be slowly leaked to
the client.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 859f11e1bc81a4d32bb3ceeae54bcd296ac675d3 | 859f11e1bc81a4d32bb3ceeae54bcd296ac675d3 |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 4b73376feecb3b61172fe5b4ff42bbbb8531669d | 4b73376feecb3b61172fe5b4ff42bbbb8531669d |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 551dfb15b182abad4600eaf7b37e6eb7000d5b1b | 551dfb15b182abad4600eaf7b37e6eb7000d5b1b |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 3363a770b193f555f29d76ddf4ced3305c0ccf6d | 3363a770b193f555f29d76ddf4ced3305c0ccf6d |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 243b206bcb5a7137e8bddd57b2eec81e1ebd3859 | 243b206bcb5a7137e8bddd57b2eec81e1ebd3859 |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < dfc6878d14acafffbe670bf2576620757a10a3d8 | dfc6878d14acafffbe670bf2576620757a10a3d8 |
| linux | linux | >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 66751841212c2cc196577453c37f7774ff363f02 | 66751841212c2cc196577453c37f7774ff363f02 |
| linux | linux_kernel | >= 5.15 < 6.6.136 | 6.6.136 |
| linux | linux_kernel | >= 6.13 < 6.18.24 | 6.18.24 |
| linux | linux_kernel | >= 6.19 < 6.19.14 | 6.19.14 |
| linux | linux_kernel | >= 6.7 < 6.12.83 | 6.12.83 |
| linux | linux_kernel | >= 7.0 < 7.0.1 | 7.0.1 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-nvidia | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 2.0
CVE-2026-46009 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drive
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 2.0
CVE-2026-46316 [LOW] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01·CVSS 2.0
CVE-2026-46042 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drivers;
- HID
Red Hat
kernel: ksmbd: validate EaNameLength in smb2_get_ea()
vendor_redhat·2026-04-24
CVE-2026-31612 CWE-130 kernel: ksmbd: validate EaNameLength in smb2_get_ea()
kernel: ksmbd: validate EaNameLength in smb2_get_ea()
A flaw was found in ksmbd, a Linux kernel module. A remote attacker can exploit this vulnerability by sending a specially crafted client request to the `smb2_get_ea()` function. Due to improper validation of the `EaNameLength` field, the system may leak uninitialized heap memory values, leading to information disclosure.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - N
GHSA
GHSA-mgh3-34fv-3j84: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate EaNameLength in smb2_get_ea()
smb2_get_ea() reads ea_req->EaName
ghsa_unreviewed·2026-04-24
CVE-2026-31612 GHSA-mgh3-34fv-3j84: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate EaNameLength in smb2_get_ea()
smb2_get_ea() reads ea_req->EaName
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate EaNameLength in smb2_get_ea()
smb2_get_ea() reads ea_req->EaNameLength from the client request and
passes it directly to strncmp() as the comparison length without
verifying that the length of the name really is the size of the input
buffer received.
Fix this up by properly checking the size of the name based on the value
received and the overall size of the request, to prevent a later
strncmp() call to use the length as a "trusted" size of the buffer.
Without this check, uninitialized heap values might be slowly leaked to
the client.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/243b206bcb5a7137e8bddd57b2eec81e1ebd3859https://git.kernel.org/stable/c/3363a770b193f555f29d76ddf4ced3305c0ccf6dhttps://git.kernel.org/stable/c/4b73376feecb3b61172fe5b4ff42bbbb8531669dhttps://git.kernel.org/stable/c/551dfb15b182abad4600eaf7b37e6eb7000d5b1bhttps://git.kernel.org/stable/c/66751841212c2cc196577453c37f7774ff363f02https://git.kernel.org/stable/c/859f11e1bc81a4d32bb3ceeae54bcd296ac675d3https://git.kernel.org/stable/c/dfc6878d14acafffbe670bf2576620757a10a3d8
2026-04-24
Published