CVE-2026-31709

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: validate the whole DACL before rewriting it in cifsacl

build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a

server-supplied dacloffset and then use the incoming ACL to rebuild the

chmod/chown security descriptor.

The original fix only checked that the struct smb_acl header fits before

reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate

header-field OOB read, but the rewrite helpers still walk ACEs based on

pdacl->num_aces with no structural validation of the incoming DACL body.

A malicious server can return a truncated DACL that still contains a

header, claims one or more ACEs, and then drive

replace_sids_and_copy_aces() or set_chmod_dacl() past the validated

extent while they compare or copy attacker-controlled ACEs.

Factor the DACL structural checks into validate_dacl(), extend them to

validate each ACE against the DACL bounds, and use the shared validator

bef

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References