Linux Kernel up to 6.12.80/6.18.21/6.19.11 ksmbd smb2_get_info_sec out-of-bounds write

Summaryinfo

A vulnerability identified as critical has been detected in Linux Kernel up to 6.12.80/6.18.21/6.19.11. Affected by this vulnerability is the function smb2_get_info_sec of the component ksmbd. The manipulation leads to out-of-bounds write. This vulnerability is uniquely identified as CVE-2026-31432. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.80/6.18.21/6.19.11. This issue affects the function smb2_get_info_sec of the component ksmbd. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as READ + QUERY_INFO(Security) is received, and the first command (READ) consumes most of the response buffer, ksmbd could write beyond the allocated buffer while building a security descriptor. The root cause was that smb2_get_info_sec() checked buffer space using ppntsd_size from xattr, while build_sec_desc() often synthesized a significantly larger descriptor from POSIX ACLs. This patch introduces smb_acl_sec_desc_scratch_len() to accurately compute the final descriptor size beforehand, performs proper buffer checking with smb2_calc_max_out_buf_len(), and uses exact-sized allocation + iov pinning.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-31432 since 03/09/2026. The exploitation is known to be easy. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/24/2026).

Upgrading to version 6.12.81, 6.18.22 or 6.19.12 eliminates this vulnerability. Applying the patch d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09/075ea208c648cc2bcd616295b711d3637c61de45/515c2daab46021221bdf406bef19bc90a44ec617/fda9522ed6afaec45cabc198d8492270c394c7bc is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1232). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Nutanix AOS
• Google Container-Optimized OS
• Debian Linux
• Google Cloud Platform
• Amazon Linux 2
• IBM Power Hardware Management Console
• Juniper JUNOS
• Red Hat Enterprise Linux
• Nutanix AHV
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IGEL OS
• LANCOM LCOS
• Open Source Linux Kernel
• RESF Rocky Linux
• Moxa Switch
• Moxa Router
• Aruba AOS-CX
• Docker Desktop
• Siemens SIMATIC S7
• Red Hat OpenShift
• Nutanix Prism Central
• Nutanix Files
• Nutanix Database Service
• Nutanix Objects
• Nutanix Data Lens
• Nutanix Flow
• Nutanix Self-Service
• Moxa MXsecurity
• IBM Storage Scale System

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10
• 6.12.11
• 6.12.12
• 6.12.13
• 6.12.14
• 6.12.15
• 6.12.16
• 6.12.17
• 6.12.18
• 6.12.19
• 6.12.20
• 6.12.21
• 6.12.22
• 6.12.23
• 6.12.24
• 6.12.25
• 6.12.26
• 6.12.27
• 6.12.28
• 6.12.29
• 6.12.30
• 6.12.31
• 6.12.32
• 6.12.33
• 6.12.34
• 6.12.35
• 6.12.36
• 6.12.37
• 6.12.38
• 6.12.39
• 6.12.40
• 6.12.41
• 6.12.42
• 6.12.43
• 6.12.44
• 6.12.45
• 6.12.46
• 6.12.47
• 6.12.48
• 6.12.49
• 6.12.50
• 6.12.51
• 6.12.52
• 6.12.53
• 6.12.54
• 6.12.55
• 6.12.56
• 6.12.57
• 6.12.58
• 6.12.59
• 6.12.60
• 6.12.61
• 6.12.62
• 6.12.63
• 6.12.64
• 6.12.65
• 6.12.66
• 6.12.67
• 6.12.68
• 6.12.69
• 6.12.70
• 6.12.71
• 6.12.72
• 6.12.73
• 6.12.74
• 6.12.75
• 6.12.76
• 6.12.77
• 6.12.78
• 6.12.79
• 6.12.80
• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.18.20
• 6.18.21
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 6.19.7
• 6.19.8
• 6.19.9
• 6.19.10
• 6.19.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion