CVE-2026-31705

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

smb2_get_ea() applies 4-byte alignment padding via memset() after

writing each EA entry. The bounds check on buf_free_len is performed

before the value memcpy, but the alignment memset fires unconditionally

afterward with no check on remaining space.

When the EA value exactly fills the remaining buffer (buf_free_len == 0

after value subtraction), the alignment memset writes 1-3 NUL bytes

past the buf_free_len boundary. In compound requests where the response

buffer is shared across commands, the first command (e.g., READ) can

consume most of the buffer, leaving a tight remainder for the QUERY_INFO

EA response. The alignment memset then overwrites past the physical

kvmalloc allocation into adjacent kernel heap memory.

Add a bounds check before the alignment memset to ensure buf_free_len

can accommodate the padding bytes.

This is the same bug pattern fixed

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References