DACL Validation Vulnerability in Linux Kernel Affects SMB Client by Multiple Vendors

CVE-2026-31709

What is CVE-2026-31709?

The Linux kernel SMB client faced a vulnerability concerning the validation of Discretionary Access Control Lists (DACLs). The issue arose when a DACL pointer derived from server input was inadequately validated, leading to potential out-of-bounds read during operations involving chmod or chown. Specifically, a malicious server could return a malformed DACL that bypassed initial structural checks, allowing the client to process attacker-controlled Access Control Entries (ACEs) without proper boundaries. To mitigate this vulnerability, improved validation methods were implemented to ensure that both the DACL and its ACEs are well-formed and comply with expected bounds before any rewrite operations are conducted.

References