CVE-2026-31432: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31432 is a high-severity out-of-bounds (OOB) write vulnerability in the Linux kernel's ksmbd SMB server implementation, specifically in the QUERY_INFO handler for compound SMB requests. When a compound request (e.g., READ + QUERY_INFO for Security) is processed and the first command consumes most of the response buffer, ksmbd can write beyond the allocated buffer while constructing a security descriptor. The vulnerability was published on April 22, 2026, and affects multiple Linux kernel stable branches. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is an incorrect buffer size calculation (CWE-131) leading to an out-of-bounds write (CWE-787). Specifically, smb2_get_info_sec() validated available buffer space using ppntsd_size derived from extended attributes (xattr), while build_sec_desc() synthesized a significantly larger security descriptor from POSIX ACLs — creating a size mismatch that allows writes past the end of the allocated response buffer. The fix introduces smb_acl_sec_desc_scratch_len() to accurately pre-compute the final descriptor size, enforces proper buffer bounds checking via smb2_calc_max_out_buf_len(), and uses exact-sized allocation with iov pinning. Exploitation requires an authenticated SMB session and the ability to send crafted compound SMB2 requests to a ksmbd-enabled server (GitHub Advisory, Feedly).

Successful exploitation allows an authenticated attacker to write data beyond the allocated kernel response buffer, potentially enabling arbitrary code execution in kernel context or causing a denial of service (kernel crash). The vulnerability affects confidentiality, integrity, and availability at a high level. Given that ksmbd operates in kernel space, a successful exploit could lead to full system compromise, privilege escalation, or persistent access (GitHub Advisory, Feedly).

As of the time of this report, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (8th percentile), indicating a low near-term exploitation probability (GitHub Advisory). Exploitation requires low privileges (an authenticated SMB user), network access to a ksmbd-enabled Linux host, and the ability to craft compound SMB2 requests.

1. Reconnaissance: Identify Linux hosts running ksmbd (kernel SMB server) exposed on the network, typically on TCP port 445. Tools like Nmap with SMB service detection can identify candidate targets.
2. Authentication: Obtain valid SMB credentials (any low-privileged user account is sufficient) to authenticate to the target ksmbd server.
3. Craft compound SMB2 request: Construct a malformed compound SMB2 request combining a READ command followed by a QUERY_INFO (Security) command. The READ command should be crafted to consume the majority of the available response buffer.
4. Trigger OOB write: Send the crafted compound request to the server. When ksmbd processes the QUERY_INFO(Security) portion, build_sec_desc() synthesizes a security descriptor from POSIX ACLs that is larger than the remaining buffer space, causing a write beyond the allocated buffer in kernel memory.
5. Achieve code execution or DoS: Depending on kernel memory layout and heap state, the OOB write may corrupt adjacent kernel structures to achieve privilege escalation or arbitrary code execution, or may trigger a kernel panic resulting in denial of service (GitHub Advisory, Feedly).

• Network: Unusual or malformed compound SMB2 requests (READ + QUERY_INFO Security) on TCP port 445 from authenticated clients; repeated SMB sessions from unexpected source IPs targeting ksmbd-enabled hosts.
• Logs: Kernel logs (dmesg, /var/log/kern.log) showing kernel panics, BUG/OOPS traces, or memory corruption errors originating from ksmbd or SMB2 handler functions; unexpected ksmbd process crashes or restarts.
• File System: Unexpected files or modifications in sensitive directories following SMB access, which may indicate post-exploitation activity after successful code execution.
• Process: Unusual child processes spawned from ksmbd worker threads; unexpected privilege escalation events in system audit logs (/var/log/audit/audit.log) correlating with SMB session activity.

Patches have been released across multiple Linux kernel stable branches. Affected users should update to the following fixed versions: 5.16 or later (for 5.15.145+), 6.2 or later (for 6.1.71+), 6.12.81 or later (for 6.6+), 6.18.22 or later (for 6.13+), 6.19.12 or later (for 6.19+), or 7.0 or later. Upstream kernel commits are available at the stable kernel repository. As a temporary workaround, restrict SMB (TCP/445) access to trusted networks using firewall rules, or disable ksmbd entirely if the SMB server functionality is not required (GitHub Advisory, Feedly).

The vulnerability attracted notable community interest due to its discovery method: security researchers used LLM-assisted techniques to identify the OOB write in ksmbd, which was discussed in a blog post titled "Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes" and shared on Reddit's r/netsec, generating community discussion about AI-assisted vulnerability research (Reddit). The vulnerability was also covered in security newsletters and aggregators including grugq's newsletter and CyberHub Blog. Red Hat acknowledged the issue via their security advisory tracker (Red Hat). Tenable published a detection plugin (Nessus plugin 309793) shortly after disclosure.