CVE-2026-31709
published 2026-05-01CVE-2026-31709: In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and…
PriorityP347high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.26%
17.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate the whole DACL before rewriting it in cifsacl
build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a
server-supplied dacloffset and then use the incoming ACL to rebuild the
chmod/chown security descriptor.
The original fix only checked that the struct smb_acl header fits before
reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate
header-field OOB read, but the rewrite helpers still walk ACEs based on
pdacl->num_aces with no structural validation of the incoming DACL body.
A malicious server can return a truncated DACL that still contains a
header, claims one or more ACEs, and then drive
replace_sids_and_copy_aces() or set_chmod_dacl() past the validated
extent while they compare or copy attacker-controlled ACEs.
Factor the DACL structural checks into validate_dacl(), extend them to
validate each ACE against the DACL bounds, and use the shared validator
before the chmod/chown rebuild paths. parse_dacl() reuses the same
validator so the read-side parser and write-side rewrite paths agree on
what constitutes a well-formed incoming DACL.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < b8603d9ae6c9087662b098619996bc4a8064319d | b8603d9ae6c9087662b098619996bc4a8064319d |
| linux | linux | >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < c2abdebf72000a64603ced84d36ccbd164f11391 | c2abdebf72000a64603ced84d36ccbd164f11391 |
| linux | linux | >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < 8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 | 8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 |
| linux | linux | >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < d92f3f0b22414e7515696a02224d0af55e3004a3 | d92f3f0b22414e7515696a02224d0af55e3004a3 |
| linux | linux | >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 | ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 |
| linux | linux | >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < b78db9bddc84136f6a0bb49e8883cf200dfb87a8 | b78db9bddc84136f6a0bb49e8883cf200dfb87a8 |
| linux | linux | >= bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 < 0a8cf165566ba55a39fd0f4de172119dd646d39a | 0a8cf165566ba55a39fd0f4de172119dd646d39a |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.12 < 7.0.2 | 7.0.2 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-nvidia | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 2.0
CVE-2026-46009 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drive
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 2.0
CVE-2026-46316 [LOW] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01·CVSS 2.0
CVE-2026-46042 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drivers;
- HID
Red Hat
kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-31709 [HIGH] CWE-1288 kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
A flaw was found in the Linux kernel's Server Message Block (SMB) client, specifically within the cifsacl functionality. A malicious SMB server could provide a malformed Discretionary Access Control List (DACL) that claims to contain more Access Control Entries (ACEs) than are actually present. This insufficient validation allows the kernel to read or copy data beyond the intended memory boundaries, leading to memory corruption. This could potentially result in information disclosure or a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat E
VulDB
Linux Kernel up to 7.0.1 SMB Client build_sec_desc out-of-bounds (WID-SEC-2026-1346)
vuldb·2026-05-17·CVSS 8.8
CVE-2026-31709 [HIGH] Linux Kernel up to 7.0.1 SMB Client build_sec_desc out-of-bounds (WID-SEC-2026-1346)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.0.1. This affects the function build_sec_desc of the component SMB Client. The manipulation leads to out-of-bounds read.
This vulnerability is traded as CVE-2026-31709. Access to the local network is required for this attack to succeed. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
GHSA-8hp2-qmc6-f97h: In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate the whole DACL before rewriting it in cifsacl
build_sec_de
ghsa_unreviewed·2026-05-01
CVE-2026-31709 [HIGH] GHSA-8hp2-qmc6-f97h: In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate the whole DACL before rewriting it in cifsacl
build_sec_de
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate the whole DACL before rewriting it in cifsacl
build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a
server-supplied dacloffset and then use the incoming ACL to rebuild the
chmod/chown security descriptor.
The original fix only checked that the struct smb_acl header fits before
reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate
header-field OOB read, but the rewrite helpers still walk ACEs based on
pdacl->num_aces with no structural validation of the incoming DACL body.
A malicious server can return a truncated DACL that still contains a
header, claims one or more ACEs, and then drive
replace_sids_and_copy_aces() or set_chmod_dacl() past the validated
extent w
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-31709 kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
bugzilla·2026-05-01
CVE-2026-31709 [HIGH] CVE-2026-31709 kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
CVE-2026-31709 kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate the whole DACL before rewriting it in cifsacl
build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a
server-supplied dacloffset and then use the incoming ACL to rebuild the
chmod/chown security descriptor.
The original fix only checked that the struct smb_acl header fits before
reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate
header-field OOB read, but the rewrite helpers still walk ACEs based on
pdacl->num_aces with no structural validation of the incoming DACL body.
A malicious server can return a truncated DACL that still contains a
header, claims one or more ACEs,
Rapid7
Patch Tuesday - May 2026
blogs_rapid7·2026-05-13·CVSS 10.0
CVE-2026-41089 [CRITICAL] Patch Tuesday - May 2026
Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday . Microsoft is not aware of exploitation in the wild or public disclosure for any of these vulnerabilities. So far this month, Microsoft has provided patches to address 133 browser vulnerabilities, which are not included in the Patch Tuesday count above.
## Windows Netlogon: critical RCE
Anyone responsible for securing a domain controller should prioritize remediation of CVE-2026-41089 , which is a critical stack-based buffer overflow in Windows Netlogon with a CVSS v3 base score of 9.8. Exploitation leads to execution in the context of the Netlogon service, so that’s SYSTEM privileges on the domain controller. For most pentesters, that’s the point at which the customer report more or less writes itself. No privileges
https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39ahttps://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319dhttps://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5https://access.redhat.com/errata/RHSA-2026:21556https://access.redhat.com/errata/RHSA-2026:21706https://access.redhat.com/errata/RHSA-2026:21745https://access.redhat.com/errata/RHSA-2026:22900https://access.redhat.com/errata/RHSA-2026:22940https://access.redhat.com/errata/RHSA-2026:23224https://access.redhat.com/errata/RHSA-2026:23237https://access.redhat.com/errata/RHSA-2026:23329https://access.redhat.com/errata/RHSA-2026:24343https://access.redhat.com/security/cve/CVE-2026-31709https://bugzilla.redhat.com/show_bug.cgi?id=2464476https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json
2026-05-01
Published