CVE-2026-31613: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31613 is an out-of-bounds heap read vulnerability in the Linux kernel's SMB client when parsing symlink error responses (STATUS_STOPPED_ON_SYMLINK). The flaw affects Linux kernel versions 6.1 through 6.18.23, 6.19 through 6.19.13, and 7.0.0. It was published on April 24, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and stems from multiple missing bounds checks in the SMB client's symlink error response parsing logic. The symlink_data() function walks SMB 3.1.1 error contexts using the loop condition p < end, but reads p->ErrorId and p->ErrorDataLength without ensuring the full context header fits within the buffer — when a server-controlled ErrorDataLength advances p to within 1–7 bytes of end, the next iteration reads past the buffer boundary. Additionally, smb2_parse_symlink_response() uses SMB2_SYMLINK_STRUCT_SIZE (computed as sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp)) as the offset of PathBuffer, which is only correct when ErrorContextCount == 0; with one or more error contexts, the symlink data is offset further, allowing the substitute name read to exceed iov_len. The fix requires loop tests to validate that the full context header fits, rejects symlink headers that run past end, and bounds the substitute name against the actual position of sym->PathBuffer (GitHub Advisory).

A malicious or compromised SMB server can send specially crafted STATUS_STOPPED_ON_SYMLINK responses that cause the Linux kernel to read heap memory beyond allocated buffer boundaries. The out-of-bounds heap bytes are UTF-16-decoded into the symlink target string and returned to userspace via readlink(2), potentially exposing sensitive kernel memory contents such as cryptographic keys, authentication tokens, or other confidential data. The vulnerability also carries a high availability impact, suggesting potential for kernel instability or crash conditions. Exploitation requires user interaction — specifically, a user must access a symlink on an attacker-controlled SMB share (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.019% (0.000190), placing it in a low probability tier for near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (mounting or browsing an attacker-controlled SMB share), which somewhat limits opportunistic exploitation.

1. Set up a malicious SMB server: Configure a rogue SMB server (e.g., using Impacket's smbserver.py or a custom SMB implementation) capable of returning crafted STATUS_STOPPED_ON_SYMLINK responses with malformed error context structures.
2. Craft malicious response: Construct a STATUS_STOPPED_ON_SYMLINK CREATE response with SMB 3.1.1 error contexts where ErrorDataLength is set to advance the parsing pointer to within 1–7 bytes of the buffer end, or where ErrorContextCount > 0 causes the substitute name bounds check to use an incorrect offset.
3. Lure victim to mount the share: Social-engineer or otherwise cause a Linux client (running a vulnerable kernel version 6.1–6.18.23, 6.19–6.19.13, or 7.0.0) to mount the malicious SMB share and access a symlink path, triggering the STATUS_STOPPED_ON_SYMLINK response.
4. Trigger OOB read: When the victim's kernel processes the crafted response, symlink_data() or smb2_parse_symlink_response() reads beyond the allocated buffer, capturing adjacent heap memory.
5. Harvest leaked data: The out-of-bounds heap bytes are UTF-16-decoded and returned to userspace via readlink(2), where the attacker (if they control the client process) or an observer can capture the leaked kernel heap contents, potentially including cryptographic material or credentials (GitHub Advisory).

• Network: Unexpected or unsolicited SMB STATUS_STOPPED_ON_SYMLINK responses from external or untrusted SMB servers; SMB traffic from unknown or unauthorized server IPs to Linux clients.
• Logs: Kernel logs (dmesg) showing SMB client parsing errors or unusual memory access warnings related to smb2_parse_symlink_response or symlink_data; audit logs showing readlink(2) syscalls returning unusually long or garbled paths from SMB-mounted filesystems.
• File System: Evidence of SMB shares mounted from external or untrusted hosts, particularly those containing symlinks; unexpected symlink resolution activity on CIFS/SMB mounts.
• Process: Processes invoking readlink on paths within CIFS-mounted filesystems returning binary or non-printable UTF-16 data, which may indicate heap data leakage.

Update the Linux kernel to the patched versions: 6.18.24 or later, 6.19.14 or later, or 7.0.1 or later, available via stable branches at git.kernel.org (GitHub Advisory). Red Hat has addressed this in RHEL 10 (RHSA-2026:23329), RHEL 9 (RHSA-2026:24381), and RHEL 8 (RHSA-2026:25120, RHSA-2026:25121); SUSE has issued SUSE-SU-2026:2310-1 (Red Hat Bugzilla). As a temporary workaround, restrict or block access to untrusted SMB servers at the network perimeter, avoid mounting SMB shares from external or untrusted sources, and apply updates through your distribution's package manager (yum, apt, zypper, etc.).

Red Hat tracked the issue via Bugzilla and issued multiple errata (RHSA-2026:23329, RHSA-2026:24381, RHSA-2026:25120, RHSA-2026:25121) addressing RHEL 8, 9, and 10 (Red Hat Bugzilla). SUSE issued a security update (SUSE-SU-2026:2310-1) and openSUSE published a corresponding announcement. The vulnerability was detected by Nessus and Qualys scanners shortly after disclosure, indicating rapid integration into commercial vulnerability management platforms.