CVE-2026-31712

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: require minimum ACE size in smb_check_perm_dacl()

Both ACE-walk loops in smb_check_perm_dacl() only guard against an

under-sized remaining buffer, not against an ACE whose declared

`ace->size` is smaller than the struct it claims to describe:

if (offsetof(struct smb_ace, access_req) > aces_size)

break;

ace_size = le16_to_cpu(ace->size);

if (ace_size > aces_size)

break;

The first check only requires the 4-byte ACE header to be in bounds;

it does not require access_req (4 bytes at offset 4) to be readable.

An attacker who has set a crafted DACL on a file they own can declare

ace->size == 4 with aces_size == 4, pass both checks, and then

granted |= le32_to_cpu(ace->access_req); /* upper loop */

compare_sids(&sid, &ace->sid); /* lower loop */

reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at

offset 8 (OOB by up to CIFS_SID_BASE_SIZE

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References