CVE-2026-31706

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()

smb_inherit_dacl() trusts the on-disk num_aces value from the parent

directory's DACL xattr and uses it to size a heap allocation:

aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...);

num_aces is a u16 read from le16_to_cpu(parent_pdacl->num_aces)

without checking that it is consistent with the declared pdacl_size.

An authenticated client whose parent directory's security.NTACL is

tampered (e.g. via offline xattr corruption or a concurrent path that

bypasses parse_dacl()) can present num_aces = 65535 with minimal

actual ACE data. This causes a ~8 MB allocation (not kzalloc, so

uninitialized) that the subsequent loop only partially populates, and

may also overflow the three-way size_t multiply on 32-bit kernels.

Additionally, the ACE walk loop uses the weaker

offsetof(struct smb_ace, access_req) minimum size check rather than

the mini

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References