CVE-2026-31614

{"id": "CVE-2026-31614", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31614", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:22:40.298481Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7449d736bbbd160c76b01b8fcdf72f58a8757d4b", "lessThan": "bfbc74df8bbe095b3ed68f6d4487b368af087890", "versionType": "git"}, {"status": "affected", "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4", "lessThan": "5cc0574c84aa73946ade587c41e81757b8b01cb5", "versionType": "git"}, {"status": "affected", "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4", "lessThan": "b2b76d09a64c538c57006180103fc1841e8cfa66", "versionType": "git"}, {"status": "affected", "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4", "lessThan": "ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18", "versionType": "git"}, {"status": "affected", "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4", "lessThan": "a893f1757d9a4009e4a8d7ceb2312142fe29cea4", "versionType": "git"}, {"status": "affected", "version": "ea41367b2a602f602ea6594fc4a310520dcc64f4", "lessThan": "3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b", "versionType": "git"}, {"status": "affected", "version": "6.6.32", "lessThan": "6.6.136", "versionType": "semver"}], "programFiles": ["fs/smb/client/smb2inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.83", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/smb2inode.c"], "defaultStatus": "affected"}]}], "published": "2026-04-24T15:16:40.663", "references": [{"url": "https://git.kernel.org/stable/c/3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5cc0574c84aa73946ade587c41e81757b8b01cb5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a893f1757d9a4009e4a8d7ceb2312142fe29cea4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b2b76d09a64c538c57006180103fc1841e8cfa66", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bfbc74df8bbe095b3ed68f6d4487b368af087890", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix off-by-8 bounds check in check_wsl_eas()\n\nThe bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA\nname and value, but ea_data sits at offset sizeof(struct\nsmb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp()\nlater reads ea->ea_data[0..nlen-1] and the value bytes follow at\nea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1\n+ vlen. Isn't pointer math fun?\n\nThe earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the\n8-byte header is in bounds, but since the last EA is placed within 8\nbytes of the end of the response, the name and value bytes are read past\nthe end of iov.\n\nFix this mess all up by using ea->ea_data as the base for the bounds\ncheck.\n\nAn \"untrusted\" server can use this to leak up to 8 bytes of kernel heap\ninto the EA name comparison and influence which WSL xattr the data is\ninterpreted as."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: corregir la comprobaci\u00f3n de l\u00edmites con un error de 8 bytes en check_wsl_eas()\n\nLa comprobaci\u00f3n de l\u00edmites usa (u8 *)ea + nlen + 1 + vlen como el final del nombre y valor de la EA, pero ea_data se encuentra en el desplazamiento sizeof(struct smb2_file_full_ea_info) = 8 desde ea, no en el desplazamiento 0. La funci\u00f3n strncmp() lee m\u00e1s tarde ea -> ea_data[0..nlen-1] y los bytes del valor siguen en ea_data[nlen+1..nlen+vlen], por lo que el final real es ea -> ea_data + nlen + 1 + vlen. \u00bfNo es divertida la aritm\u00e9tica de punteros?\n\nLa comprobaci\u00f3n anterior (u8 *)ea > end - sizeof(ea) solo garantiza que la cabecera de 8 bytes est\u00e1 dentro de los l\u00edmites, pero dado que la \u00faltima EA se coloca dentro de los 8 bytes del final de la respuesta, los bytes del nombre y del valor se leen m\u00e1s all\u00e1 del final de iov.\n\nSolucionar todo este l\u00edo usando ea -> ea_data como base para la comprobaci\u00f3n de l\u00edmites.\n\nUn servidor \u2019no confiable\u2019 puede usar esto para filtrar hasta 8 bytes de la pila del kernel en la comparaci\u00f3n del nombre de la EA e influir en c\u00f3mo se interpreta el dato para qu\u00e9 xattr de WSL."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1487B72A-0930-4903-A6AE-173E355D9209", "versionEndExcluding": "6.6.136", "versionStartIncluding": "6.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABBF18DE-4F74-47AB-B0B1-8493B33EDC1E", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}