CVE-2026-31614

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix off-by-8 bounds check in check_wsl_eas()

The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA

name and value, but ea_data sits at offset sizeof(struct

smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp()

later reads ea->ea_data[0..nlen-1] and the value bytes follow at

ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1

+ vlen. Isn't pointer math fun?

The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the

8-byte header is in bounds, but since the last EA is placed within 8

bytes of the end of the response, the name and value bytes are read past

the end of iov.

Fix this mess all up by using ea->ea_data as the base for the bounds

check.

An "untrusted" server can use this to leak up to 8 bytes of kernel heap

into the EA name comparison and influence which WSL xattr the data is

interpreted as.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References