CVE-2026-31707

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate response sizes in ipc_validate_msg()

ipc_validate_msg() computes the expected message size for each

response type by adding (or multiplying) attacker-controlled fields

from the daemon response to a fixed struct size in unsigned int

arithmetic. Three cases can overflow:

KSMBD_EVENT_RPC_REQUEST:

msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz;

KSMBD_EVENT_SHARE_CONFIG_REQUEST:

msg_sz = sizeof(struct ksmbd_share_config_response) +

resp->payload_sz;

KSMBD_EVENT_LOGIN_REQUEST_EXT:

msg_sz = sizeof(struct ksmbd_login_response_ext) +

resp->ngroups * sizeof(gid_t);

resp->payload_sz is __u32 and resp->ngroups is __s32. Each addition

can wrap in unsigned int; the multiplication by sizeof(gid_t) mixes

signed and size_t, so a negative ngroups is converted to SIZE_MAX

before the multiply. A wrapped value of msg_sz that happens to

equal entry->m

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References