Out-of-Bounds Write Vulnerability in Linux Kernel's KSmbd SMB2 Functionality

CVE-2026-31705

What is CVE-2026-31705?

The vulnerability in the Linux kernel's ksmbd component arises from a failure to properly check buffer boundaries before writing alignment padding during SMB2 operations. Specifically, when handling Extended Attributes (EAs) in the smb2_get_ea() function, the code sets 4-byte alignment padding unconditionally after writing each EA entry. This oversight can lead to out-of-bounds writes when the buffer length is insufficient, potentially overwriting adjacent kernel heap memory. Proper bounds checks must be implemented before performing these writes to mitigate this risk, which parallels previous fixes for similar vulnerabilities in compound request handling.

References