CVE-2026-31433— ksmbd: fix potencial OOB in get_file_all_info() for compound requests
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-31433
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ksmbd: fix potencial OOB in get_file_all_info() for compound requests
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound request consists of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) and the first command consumes nearly the entire max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16() with PATH_MAX, causing out-of-bounds write beyond the response buffer. In get_file_all_info(), there was a missing validation check for the client-provided OutputBufferLength before copying the filename into FileName field of the smb2_file_all_info structure. If the filename length exceeds the available buffer space, it could lead to potential buffer overflows or memory corruption during smbConvertToUTF16 conversion. This calculating the actual free buffer size using smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is insufficient and updating smbConvertToUTF16 to use the actual filename length (clamped by PATH_MAX) to ensure a safe copy operation.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ksmbd在处理复合请求QUERY_DIRECTORY + QUERY_INFO(FILE_ALL_INFORMATION)时存在潜在越界写入，可能导致smbConvertToUTF16转换时超出响应缓冲区。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-31433
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-31433
Please Login to view more intelligence information
Same Patch Batch · Linux · 2026-04-22 · 100 CVEs total
| CVE-2026-31463 | 9.8 CRITICAL | iomap: fix invalid folio access when i_blkbits differs from I/O granularity |
| CVE-2026-31436 | 9.8 CRITICAL | dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() |
| CVE-2026-31444 | 9.8 CRITICAL | ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() |
| CVE-2026-31478 | 9.8 CRITICAL | ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() |
| CVE-2026-31501 | 9.8 CRITICAL | net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path |
| CVE-2026-31448 | 9.4 CRITICAL | ext4: avoid infinite loops caused by residual data |
| CVE-2026-31432 | 8.8 HIGH | ksmbd: fix OOB write in QUERY_INFO for compound requests |
| CVE-2026-31435 | 8.8 HIGH | netfs: Fix read abandonment during retry |
| CVE-2026-31450 | 8.8 HIGH | ext4: publish jinode after initialization |
| CVE-2026-31476 | 8.2 HIGH | ksmbd: do not expire session on binding failure |
| CVE-2026-31464 | 8.1 HIGH | scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() |
| CVE-2026-31513 | 8.1 HIGH | Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req |
| CVE-2026-31488 | 7.8 HIGH | drm/amd/display: Do not skip unrelated mode changes in DSC validation |
| CVE-2026-31479 | 7.8 HIGH | drm/xe: always keep track of remap prev/next |
| CVE-2026-31490 | 7.8 HIGH | drm/xe/pf: Fix use-after-free in migration restore |
| CVE-2026-31494 | 7.8 HIGH | net: macb: use the current queue number for stats |
| CVE-2026-31502 | 7.8 HIGH | team: fix header_ops type confusion with non-Ethernet ports |
| CVE-2026-31449 | 7.8 HIGH | ext4: validate p_idx bounds in ext4_ext_correct_indexes |
| CVE-2026-31504 | 7.8 HIGH | net: fix fanout UAF in packet_release() via NETDEV_UP race |
| CVE-2026-31505 | 7.8 HIGH | iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() |
Showing top 20 of 100 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling - CVE-2026-43471
scsi: ufs: core: Fix possible NULL pointer dereference in uf
Same vendor: Linux
- CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling - CVE-2026-43471
scsi: ufs: core: Fix possible NULL pointer dereference in uf
V. Comments for CVE-2026-31433
No comments yet