CVE-2026-31611: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-31611 is an out-of-bounds memory read vulnerability in the Linux kernel's ksmbd (kernel SMB server) subsystem, specifically in the parse_dacl() function's SID comparison logic. An unauthenticated network attacker can craft a malformed SMB security descriptor to trigger a read 4 bytes past the end of the ACL boundary, causing arbitrary POSIX file mode corruption on SMB shares. Affected Linux kernel versions include 5.15–6.6.135, 6.7–6.12.82, 6.13–6.18.23, 6.19–6.19.13, and 7.0.0. The vulnerability was published on April 24, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 8.6 (High), assigned by kernel.org (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of a specified index/offset in input (CWE-1285). In parse_dacl(), each ACE SID is compared against sid_unix_NFS_mode (S-1-5-88-3, num_subauth = 2) using compare_sids(), which only checks min(num_subauth, 2) sub-authorities. A crafted client SID with num_subauth = 2 and sub_auth = {88, 3} will match this prefix without actually carrying a third sub-authority. If such a malformed ACE is placed at the very end of the security descriptor, the subsequent read of sid.sub_auth[2] accesses memory 4 bytes past end_of_acl. The out-of-bounds bytes are then masked to the low 9 bits and applied as the file's POSIX mode permissions (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated remote attacker to corrupt POSIX file mode permissions on SMB shares served by the ksmbd subsystem. Attackers can escalate access rights to restricted files, deny legitimate users access to critical resources, or set file modes to unintended values — all without any authentication. While the primary impact is integrity and availability of file permissions, the out-of-bounds read also introduces a limited confidentiality risk through exposure of adjacent kernel memory content (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is remotely exploitable with no authentication or user interaction required, lowering the barrier for potential attackers. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify Linux systems running ksmbd (kernel SMB server) with SMB port 445/tcp exposed, targeting kernel versions 5.15–6.6.135, 6.7–6.12.82, 6.13–6.18.23, 6.19–6.19.13, or 7.0.0 using network scanners such as Nmap or Shodan.
2. Craft malformed security descriptor: Construct an SMB2 SET_INFO request containing a DACL (Discretionary Access Control List) with a specially crafted ACE whose SID has num_subauth = 2 and sub_auth = {88, 3}, matching the sid_unix_NFS_mode prefix (S-1-5-88-3) without carrying the required third sub-authority.
3. Position ACE at end of descriptor: Place the malformed ACE at the very end of the security descriptor so that sub_auth[2] falls 4 bytes past the end_of_acl boundary, causing the out-of-bounds read.
4. Trigger file mode corruption: Send the crafted request to a target SMB share; the ksmbd server reads the out-of-bounds bytes, masks them to 9 bits, and applies the result as the POSIX file mode — potentially granting world-writable or world-readable permissions to sensitive files, or removing access entirely.
5. Achieve objective: Leverage the corrupted file permissions to access previously restricted files, escalate privileges, or deny service to legitimate users on the affected SMB share (GitHub Advisory).

• Network: Unusual or malformed SMB2 SET_INFO requests on TCP port 445 containing ACE SIDs with num_subauth = 2 matching the S-1-5-88-3 prefix; unexpected SMB traffic from untrusted or external IP addresses targeting ksmbd shares.
• File System: Unexpected changes to POSIX file permissions (mode bits) on files hosted on SMB shares, particularly world-readable or world-writable permissions on sensitive files; permission changes not correlated with legitimate administrative activity.
• Logs: Kernel log entries (dmesg or /var/log/kern.log) referencing ksmbd ACL parsing errors or anomalous security descriptor processing; SMB server access logs showing repeated SET_INFO operations from a single client.
• Process: Unusual ksmbd kernel thread activity coinciding with permission changes on SMB-hosted files.

Apply the available kernel security updates immediately. Fixed versions are: 6.6.136 and later (for 5.15–6.6.x branch), 6.12.83 and later (for 6.7–6.12.x branch), 6.18.24 and later (for 6.13–6.18.x branch), 6.19.14 and later (for 6.19.x branch), and 7.0.1 and later (for 7.0.x branch). Specific patch commits are available at git.kernel.org. If immediate patching is not feasible, restrict network access to SMB port 445/tcp using firewall rules, implement network segmentation to limit exposure to untrusted clients, and monitor SMB shares for unexpected file permission changes (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was detected by Tenable's Nessus scanner (plugin 310296) and noted in the Yocto Project security mailing list, indicating awareness in embedded Linux communities. No significant public researcher commentary, vendor statements beyond the kernel patch, or notable media coverage has been identified at this time (Tenable Nessus, Yocto Security List).