CVE-2026-31705: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-31705 is an out-of-bounds write vulnerability in the Linux kernel's ksmbd SMB server, specifically in the smb2_get_ea() function responsible for handling Extended Attribute (EA) responses. The flaw was published on May 1, 2026, and affects multiple Linux kernel stable branches. Affected versions include kernels from 5.15.145 up to (but not including) 5.16, 6.1.71–6.2, 6.6–6.6.136, 6.7–6.12.84, 6.13–6.18.25, and 6.19–7.0.2 (Red Hat CVE, Feedly). It carries a CVSS v3.1 base score of 9.8 (Critical), reflecting network-exploitable, unauthenticated, no-user-interaction attack conditions (Feedly).

The root cause is an out-of-bounds write (CWE-787) in smb2_get_ea() within the ksmbd kernel SMB server. After writing each EA entry, the function applies 4-byte alignment padding via an unconditional memset(), but the bounds check on buf_free_len is only performed before the EA value memcpy — not before the subsequent alignment memset. When an EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1–3 NUL bytes past the buffer boundary into adjacent kernel heap memory (Feedly). This condition is particularly exploitable in compound SMB2 requests where a shared response buffer is partially consumed by an earlier command (e.g., READ), leaving a tight remainder for the QUERY_INFO EA response. The fix follows the same pattern as commits beef2634f81f and fda9522ed6af, which added bounds checks before unconditional writes in other QUERY_INFO response handlers (Feedly).

Successful exploitation allows an unauthenticated remote attacker to write out-of-bounds into adjacent kernel heap memory, which can corrupt kernel state, cause a system crash (denial of service), or potentially achieve arbitrary code execution in kernel context (Feedly). The vulnerability affects confidentiality, integrity, and availability at the highest severity, as kernel-level code execution would grant complete control over the affected system. In environments where ksmbd is exposed to untrusted networks, this could serve as an initial access vector enabling full host compromise and lateral movement.

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term (Feedly). No threat actor attribution has been reported. However, the unauthenticated, network-accessible nature of the flaw and its critical CVSS score make it a high-priority patching target.

1. Reconnaissance: Identify Linux systems running the ksmbd kernel SMB server (typically listening on TCP port 445) using network scanners such as Nmap or Shodan, targeting kernel versions within the affected ranges.
2. Craft compound SMB2 request: Construct a compound SMB2 request that includes an initial command (e.g., READ) designed to consume most of the shared response buffer, leaving minimal space for the subsequent QUERY_INFO EA response.
3. Trigger EA boundary condition: In the QUERY_INFO command of the compound request, specify Extended Attribute (EA) data sized to exactly fill the remaining buffer space (buf_free_len), so that after the EA value is written, buf_free_len equals zero.
4. Trigger out-of-bounds write: The server's smb2_get_ea() function executes the unconditional alignment memset() without checking remaining buffer space, writing 1–3 NUL bytes past the buffer boundary into adjacent kernel heap memory.
5. Achieve impact: Depending on heap layout, the out-of-bounds write may corrupt adjacent kernel objects, leading to a kernel panic (DoS) or, with heap grooming techniques, potentially enabling kernel-level code execution (Feedly).

• Network: Unusual or malformed SMB2 compound requests on TCP port 445, particularly those combining READ and QUERY_INFO commands with EA data; unexpected high-volume SMB traffic from untrusted sources.
• Logs: Kernel logs (dmesg, /var/log/kern.log) showing memory corruption errors, BUG/OOPS traces, or slab allocator warnings originating from ksmbd or smb2 subsystems; unexpected kernel panics or system reboots.
• Process: Unexpected kernel crashes or hung tasks associated with the ksmbd kernel thread; anomalous process spawning from kernel context.
• File System: Unexpected new files or modified binaries on systems running ksmbd, which may indicate post-exploitation activity following a successful kernel compromise.

Apply kernel updates containing the fix: Linux kernel versions 5.15.145+, 6.1.71+, 6.6.136+, 6.12.84+, 6.18.25+, and 7.0.2+ include the patch via stable branch commits 30010c952077, 790304c02bf9, 922d48fe8c19, 98f3de6ef4ef, and ffbce350c6fd (Feedly, Red Hat CVE). As a workaround, disable the ksmbd module if SMB server functionality is not required (modprobe -r ksmbd), or restrict network access to TCP port 445 using firewall rules to limit exposure to trusted hosts only. Monitor systems for unexpected kernel crashes or memory corruption errors that may indicate exploitation attempts.

Red Hat has tracked this vulnerability and published an advisory page (Red Hat CVE). The openSUSE security team issued a security announcement addressing this CVE (openSUSE Security). The Yocto Project security mailing list has discussed the vulnerability across multiple threads, reflecting broad embedded Linux ecosystem awareness. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE tracking and distribution-level advisories.