CVE-2026-31712 Linux CVE debrief

Who should care

Linux kernel and distro security teams, SMB/ksmbd operators, and administrators who allow authenticated users to set ACLs on shared files.

Technical summary

The flaw is in smb_check_perm_dacl(). Both ACE-walk loops checked only that the remaining buffer was large enough for the ACE header and then trusted ace->size, which allowed a crafted ACE with ace->size == 4 to pass validation even though later code reads access_req at offset 4 and sid at offset 8. The fix requires a minimum ACE size of offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE and rejects ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES before compare_sids() dereferences sub_auth[]. The issue is an out-of-bounds read (CWE-787), not pre-auth, and is reachable only after an authenticated client stores a crafted DACL and later triggers permission evaluation.

Defensive priority

High

Recommended defensive actions

• Apply the upstream or stable Linux kernel fixes linked in the official references and backport them to supported kernels.
• Confirm ksmbd-enabled systems are not running vulnerable kernel ranges: 5.15 before 6.12.84, 6.13 before 6.18.25, or 6.19 before 7.0.2.
• Validate that your kernel includes the ACE minimum-size check and the sid.num_subauth bounds check in smb_check_perm_dacl().
• Restrict which authenticated SMB users can set ACLs on files and review share permissions for unnecessary ACL delegation.
• Monitor affected systems for ksmbd-related kernel warnings, KASAN reports, or crashes during CREATE operations against files with stored DACLs.

Evidence notes

The CVE description states that smb_check_perm_dacl() only checked the remaining buffer and not the minimum ACE layout, allowing ace->size == 4 to pass and then read access_req and sid out of bounds. It also states that compare_sids() could dereference sub_auth[] without first bounding sid.num_subauth, and that parse_sec_desc() already enforced an equivalent check. Reachability is described as an authenticated SMB client with permission to set an ACL, followed by a later CREATE against the same file. The record classifies the weakness as CWE-787 and provides the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.