CVE-2026-31478 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value.
A vulnerability in the Linux kernel's ksmbd component has been addressed. The issue involved the response buffer management for SMB2 protocol, which was previously hardcoded with a magic number. This vulnerability affected several versions of the Linux kernel. The response management has been updated to use a dynamic I/O array, requiring the second argument of the 'smb2_calc_max_out_buf_len()' function to be the offset of the 'Buffer' field in the response structure, rather than a fixed number. The vulnerability arose after a commit that introduced support for read compound operations, which changed how response buffers were handled. The issue could potentially lead to incorrect buffer lengths being calculated, causing issues in data handling during SMB2 operations.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that fixes this issue can be found in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0e55f63dd08f09651d39e1b709a91705a8a0ddcb | kernel.org | Patch |
| https://git.kernel.org/stable/c/4cb537ae4f37d7d0f617815ed4bed7173fb50861 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6aef1765d6807e0f027cd87f6ac973eb0879a46d | kernel.org | Patch |
| https://git.kernel.org/stable/c/70b4c414889492c522b6e4331562360f49be2361 | kernel.org | Patch |
| https://git.kernel.org/stable/c/80824c7e527b70cf9039534e60aff592e8f209d1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9a7166f0ef8cbb7bb48dd05e2471d995566003f5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.15.145, < 5.15.203 >= 6.1.71, < 6.1.168 >= 6.6.1, < 6.6.131 >= 6.7, < 6.12.80 >= 6.13, < 6.18.21 >= 6.19, < 6.19.11 6.6 - 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 7.0 rc7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | kernel.org |
| Apr 22, 2026 | New CVE Received | kernel.org |