CVE-2026-31478: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31478 is a buffer size calculation flaw in the Linux kernel's ksmbd (kernel SMB2 server) subsystem. The vulnerability exists in smb2_calc_max_out_buf_len(), which uses hardcoded magic numbers instead of the correct offsetof() values to calculate the offset of the ->Buffer field in SMB2 response structures. This regression was introduced after commit e2b76ab8b5c9 ("ksmbd: add support for read compound"), which changed response buffer management to use dynamic iov arrays but left several call sites uncorrected. Affected Linux kernel versions include 5.15.145–5.15.202, 6.1.71–6.1.167, 6.6.1–6.6.130, 6.7–6.12.79, 6.13–6.18.20, and 6.19–6.19.10, as well as 7.0 release candidates. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-131 (Incorrect Calculation of Buffer Size). After the ksmbd subsystem was refactored to use dynamic iov arrays for response buffer management, smb2_calc_max_out_buf_len() was updated to expect the second argument (hdr2_len) to represent the offsetof() value of the ->Buffer field in the relevant response structure. However, several call sites continued passing hardcoded magic numbers, resulting in incorrect buffer length calculations. This flaw is exploitable over the network without authentication, as ksmbd handles incoming SMB2 protocol requests at the kernel level, and a malformed or crafted SMB2 request could trigger the miscalculated buffer boundary, leading to memory corruption or overflow conditions (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to trigger buffer overflow conditions, kernel memory corruption, or a kernel denial of service on systems running the vulnerable ksmbd SMB2 server. Given the network-facing nature of the flaw and the absence of authentication requirements, the potential for confidentiality, integrity, and availability impact is rated high across all three dimensions. In a worst-case scenario, memory corruption at the kernel level could be leveraged for privilege escalation or arbitrary code execution within the kernel context (Feedly, GitHub Advisory).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.03%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection coverage exists via Nessus plugin 309840 (Tenable).

• Network: Unusual or malformed SMB2 protocol traffic directed at systems with ksmbd enabled; unexpected SMB2 compound read requests from untrusted sources.
• Logs: Kernel panic or oops messages in /var/log/kern.log or dmesg output referencing ksmbd or smb2 buffer handling; unexpected kernel BUG or WARN traces involving smb2_calc_max_out_buf_len.
• Process: Unexpected ksmbd worker thread crashes or restarts; elevated kernel error rates visible via dmesg -T around SMB2 request processing.

Patches are available across multiple stable kernel branches. Administrators should update to the following fixed versions or later: 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0 (stable release). Upstream fix commits are available at git.kernel.org for each affected branch. For systems that cannot be patched immediately, disabling or restricting access to the ksmbd service (if not operationally required) is recommended as a temporary workaround. Additionally, network-level controls such as firewall rules blocking SMB ports (TCP 445) from untrusted networks can reduce exposure (GitHub Advisory, Red Hat Bugzilla).