Out-of-Bounds Read in Linux Kernel SMB Client Affects Multiple Versions

CVE-2026-31708

What is CVE-2026-31708?

A vulnerability in the Linux kernel's SMB client can lead to an out-of-bounds read when handling QUERY_INFO requests. The flaw arises due to the lack of proper validation on the response length from malicious servers, allowing them to return a larger OutputBufferLength than the actual response. This oversight could enable an attacker to expose adjacent kernel heap memory to userspace, leading to potential data leakage or system compromise. The vulnerability has been addressed by implementing a bounds check and using structured size calculations to prevent overflows, thus securing user memory access during the QUERY_INFO process.

References