Look up another CVE · open CVE-2026-31707 in the interactive tracker
CVE-2026-31707
ksmbd: validate response sizes in ipc_validate_msg()
Published 2026-05-01 (6 months ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-31707 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.85-1 | Update the kernel and reboot. Fixed in 6.12.85-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.3-1 | Update the kernel and reboot. Fixed in 7.0.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.3-1 | Update the kernel and reboot. Fixed in 7.0.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ipc_validate_msg() computes the expected message size for each response type by adding (or multiplying) attacker-controlled fields from the daemon response to a fixed struct size in unsigned int arithmetic. Three cases can overflow: KSMBD_EVENT_RPC_REQUEST: msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; KSMBD_EVENT_SHARE_CONFIG_REQUEST: msg_sz = sizeof(struct ksmbd_share_config_response) + resp->payload_sz; KSMBD_EVENT_LOGIN_REQUEST_EXT: msg_sz = sizeof(struct ksmbd_login_response_ext) + resp->ngroups * sizeof(gid_t); resp->payload_sz is __u32 and resp->ngroups is __s32. Each addition can wrap in unsigned int; the multiplication by sizeof(gid_t) mixes signed and size_t, so a negative ngroups is converted to SIZE_MAX before the multiply. A wrapped value of msg_sz that happens to equal entry->msg_sz bypasses the size check on the next line, and downstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz, kmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the unverified length. Use check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST paths to detect integer overflow without constraining functional payload size; userspace ksmbd-tools grows NDR responses in 4096-byte chunks for calls like NetShareEnumAll, so a hard transport cap is unworkable on the response side. For LOGIN_REQUEST_EXT, reject resp->ngroups outside the signed [0, NGROUPS_MAX] range up front and report the error from ipc_validate_msg() so it fires at the IPC boundary; with that bound the subsequent multiplication and addition stay well below UINT_MAX. The now-redundant ngroups check and pr_err in ksmbd_alloc_user() are removed. This is the response-side analogue of aab98e2dbd64 ("ksmbd: fix integer overflows on 32 bit systems"), which hardened the request side.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/server/mgmt/user_config.c
fs/smb/server/transport_ipc.c
- What this is
- KERNEL SMB3 SERVER (KSMBD)MAINTAINERS section matched on fs/smb/server/ · linux-cifs@vger.kernel.org · Maintained
- Kernel module
- ksmbd
Check it on the machine
grep -wE 'CONFIG_SMBFS|CONFIG_SMB_SERVER' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ksmbdPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_SMBFS, CONFIG_SMB_SERVER
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-05-01 (6 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.15 | 6.6.141 | bf3962084183 |
| 5.15 | 6.12.84 | 7dd0c858e190 |
| 5.15 | 6.18.25 | 299db777ea0c |
| 5.15 | 7.0.2 | 99c631d0366c |
| 5.15 | 7.1 | d6a6aa81eac2 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The malformed length fields enter the kernel through ksmbd generic-netlink IPC response messages, not directly from SMB network packets. SMB traffic can create the pending request, but the attacker must be local to inject or control the IPC response.
- AC:LAttack complexity, low
- The attacker controls the response fields and can choose wrapped sizes that satisfy the old equality check. Any response race is practical because handles are small/predictable and the attacker can trigger repeated pending requests.
- PR:LPrivileges required, low
- The IPC response handlers are gated by CAP_NET_ADMIN when the default check is enabled, but the generic-netlink family is netns-aware and CAP_NET_ADMIN is commonly reachable from an unprivileged user namespace. If that check is disabled, no capability is needed, so Low is the conservative privilege choice.
- UI:NUser interaction, none
- No victim user action is required once ksmbd is running. The attacker can trigger the SMB-side request and send the crafted IPC response directly.
- S:UScope, unchanged
- The vulnerability affects kernel memory and ksmbd state within the same host security authority. It does not cross a VM, IOMMU, or separate sandbox boundary.
- C:HConfidentiality impact, high
- The wrapped RPC response size can make downstream code copy data beyond the validated response buffer, including into SMB responses. This can disclose kernel heap memory and is best scored as high confidentiality impact.
- I:NIntegrity impact, none
- The investigated consumers primarily perform oversized reads from the undersized IPC response or fail large allocations. I did not find a direct out-of-bounds write or control-flow overwrite primitive from this bug alone.
- A:HAvailability impact, high
- The oversized copies and huge allocations can trigger kernel faults, memory exhaustion, or service failure. Repeated crafted responses can therefore produce high availability impact.