CVE-2026-31708: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31708 is an out-of-bounds (OOB) read vulnerability in the Linux kernel's SMB client, specifically in the smb2_ioctl_query_info() function's QUERY_INFO response-handling path. A malicious SMB server can return an OutputBufferLength value larger than the actual response buffer, causing copy_to_user() to read past the buffer boundary and expose adjacent kernel heap memory to userspace. The vulnerability affects Linux kernel versions from 5.1 up to (but not including) 6.6.136, 6.7–6.12.84, 6.13–6.18.25, and 6.19–7.0.2. It was published on May 1, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-805 (Buffer Access with Incorrect Length Value). In smb2_ioctl_query_info(), the QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies that many bytes from qi_rsp->Buffer to userspace via copy_to_user(), but never validates that the flexible-array payload actually fits within rsp_iov[1].iov_len. The fix adds a bounds check using struct_size(qi_rsp, Buffer, qi.input_buffer_length) — rather than an open-coded addition — to prevent overflow on 32-bit builds and ensure the copy is bounded by the actual response buffer size. Exploitation requires a user on the vulnerable system to connect to a malicious SMB server (Red Hat Advisory, Kernel Patch).

Successful exploitation allows an attacker controlling a malicious SMB server to read sensitive kernel heap memory from a connecting client system, potentially exposing credentials, cryptographic keys, and other sensitive kernel data structures. The confidentiality impact is high, while integrity is unaffected; availability impact is also rated high, suggesting the OOB read could additionally trigger kernel instability or crashes. The attack requires user interaction (a user must connect to the malicious server) but no privileges on the attacker's side (Red Hat Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low current probability of exploitation in the wild. No threat actor attribution has been reported.

1. Set up a malicious SMB server: The attacker configures a rogue SMB server (e.g., using a modified Samba or custom SMB2 implementation) that responds to QUERY_INFO requests with a crafted response where OutputBufferLength is set to a value larger than the actual data in the response buffer.
2. Lure the victim to connect: The attacker induces a user on a vulnerable Linux system (kernel 5.1–6.6.135, 6.7–6.12.83, 6.13–6.18.24, or 6.19–7.0.1) to mount or access a share on the malicious server, for example via a phishing link, a malicious network share reference, or a man-in-the-middle attack on an existing SMB connection.
3. Trigger the vulnerable code path: The victim's kernel issues an smb2_ioctl_query_info() call that reaches the QUERY_INFO branch. The malicious server returns a response with an inflated OutputBufferLength.
4. OOB read occurs: The kernel's copy_to_user() reads beyond the actual response buffer boundary, copying adjacent kernel heap memory into the userspace buffer controlled by the attacker's server response.
5. Exfiltrate kernel heap data: The attacker's server receives or the attacker reads the leaked kernel heap content, which may include credentials, cryptographic material, or other sensitive kernel data structures (Red Hat Advisory, Feedly).

• Network: Unexpected outbound SMB (TCP port 445) connections from Linux hosts to external or untrusted IP addresses; SMB sessions to servers not in the organization's approved server list.
• Logs: Kernel logs (dmesg, /var/log/kern.log) showing SMB client errors or unusual memory access warnings related to smb2_ioctl_query_info; audit logs showing mount or SMB-related syscalls to unknown hosts.
• Process: Unusual processes initiating SMB mounts (e.g., user-space applications unexpectedly calling mount.cifs or smbclient to external addresses).
• File System: Unexpected CIFS/SMB mount points visible in /proc/mounts or via mount output pointing to external or unknown servers.

Update the Linux kernel to a patched version: 6.6.136 or later (for the 6.6.x branch), 6.12.84 or later (for the 6.12.x branch), 6.18.25 or later (for the 6.18.x branch), or 7.0.2 or later (for the 7.0.x branch). Patches are available via the upstream stable kernel tree and have been incorporated into distributions including Red Hat, Amazon Linux 2023, and openSUSE (Red Hat Advisory, Amazon Linux, openSUSE). As a workaround where patching is not immediately possible, restrict SMB client connections to trusted, known-good servers only, and block outbound SMB traffic (TCP 445) to untrusted external hosts at the network perimeter.

The vulnerability received standard coverage from vulnerability tracking services and distribution security teams shortly after disclosure. Red Hat, Amazon Linux, openSUSE, and the Yocto Project all issued advisories or security notices. Tenable published a Nessus detection plugin (ID 319865). No notable researcher commentary or significant social media discussion beyond routine CVE tracking has been identified (Red Hat Advisory, Amazon Linux, Tenable).