CVE-2026-31707

{"id": "CVE-2026-31707", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "52518503a1a00bc33e9522c4eb05df023e3ae978", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "bf396208418371174869baba9434535cd3288e80", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "7dd0c858e1909769a4c91842724315ee74f1a5f1", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "299db777ea0cfa5c407e41b045c24a14c034c27b", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "99c631d0366c1eab8fb188fe66425f4581ebdde4", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "d6a6aa81eac2c9bff66dc6e191179cb69a14426b", "versionType": "git"}], "programFiles": ["fs/smb/server/mgmt/user_config.c", "fs/smb/server/transport_ipc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.141", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.84", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.25", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/server/mgmt/user_config.c", "fs/smb/server/transport_ipc.c"], "defaultStatus": "affected"}]}], "published": "2026-05-01T14:16:20.720", "references": [{"url": "https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/52518503a1a00bc33e9522c4eb05df023e3ae978", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bf396208418371174869baba9434535cd3288e80", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate response sizes in ipc_validate_msg()\n\nipc_validate_msg() computes the expected message size for each\nresponse type by adding (or multiplying) attacker-controlled fields\nfrom the daemon response to a fixed struct size in unsigned int\narithmetic. Three cases can overflow:\n\n KSMBD_EVENT_RPC_REQUEST:\n msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz;\n KSMBD_EVENT_SHARE_CONFIG_REQUEST:\n msg_sz = sizeof(struct ksmbd_share_config_response) +\n resp->payload_sz;\n KSMBD_EVENT_LOGIN_REQUEST_EXT:\n msg_sz = sizeof(struct ksmbd_login_response_ext) +\n resp->ngroups * sizeof(gid_t);\n\nresp->payload_sz is __u32 and resp->ngroups is __s32. Each addition\ncan wrap in unsigned int; the multiplication by sizeof(gid_t) mixes\nsigned and size_t, so a negative ngroups is converted to SIZE_MAX\nbefore the multiply. A wrapped value of msg_sz that happens to\nequal entry->msg_sz bypasses the size check on the next line, and\ndownstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz,\nkmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the\nunverified length.\n\nUse check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST\npaths to detect integer overflow without constraining functional\npayload size; userspace ksmbd-tools grows NDR responses in 4096-byte\nchunks for calls like NetShareEnumAll, so a hard transport cap is\nunworkable on the response side. For LOGIN_REQUEST_EXT, reject\nresp->ngroups outside the signed [0, NGROUPS_MAX] range up front and\nreport the error from ipc_validate_msg() so it fires at the IPC\nboundary; with that bound the subsequent multiplication and addition\nstay well below UINT_MAX. The now-redundant ngroups check and\npr_err in ksmbd_alloc_user() are removed.\n\nThis is the response-side analogue of aab98e2dbd64 (\"ksmbd: fix\ninteger overflows on 32 bit systems\"), which hardened the request\nside."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: validar tama\u00f1os de respuesta en ipc_validate_msg()\n\nipc_validate_msg() calcula el tama\u00f1o de mensaje esperado para cada tipo de respuesta sumando (o multiplicando) campos controlados por el atacante de la respuesta del demonio a un tama\u00f1o de estructura fijo en aritm\u00e9tica de entero sin signo. Tres casos pueden desbordarse:\n\n KSMBD_EVENT_RPC_REQUEST:\n msg_sz = sizeof(struct ksmbd_rpc_command) + resp -> payload_sz;\n KSMBD_EVENT_SHARE_CONFIG_REQUEST:\n msg_sz = sizeof(struct ksmbd_share_config_response) +\n resp -> payload_sz;\n KSMBD_EVENT_LOGIN_REQUEST_EXT:\n msg_sz = sizeof(struct ksmbd_login_response_ext) +\n resp -> ngroups * sizeof(gid_t);\n\nresp -> payload_sz es __u32 y resp -> ngroups es __s32. Cada suma puede envolverse en entero sin signo; la multiplicaci\u00f3n por sizeof(gid_t) mezcla con signo y size_t, por lo que un ngroups negativo se convierte a SIZE_MAX antes de la multiplicaci\u00f3n. Un valor envuelto de msg_sz que resulta ser igual a entry -> msg_sz omite la comprobaci\u00f3n de tama\u00f1o en la siguiente l\u00ednea, y los consumidores posteriores (smb2pdu.c:6742 memcpy usando rpc_resp -> payload_sz, kmemdup en ksmbd_alloc_user usando resp_ext -> ngroups) entonces conf\u00edan en la longitud no verificada.\n\nUsar check_add_overflow() en las rutas RPC_REQUEST y SHARE_CONFIG_REQUEST para detectar desbordamiento de entero sin restringir el tama\u00f1o de carga \u00fatil funcional; las herramientas ksmbd del espacio de usuario aumentan las respuestas NDR en bloques de 4096 bytes para llamadas como NetShareEnumAll, por lo que un l\u00edmite de transporte estricto es inviable en el lado de la respuesta. Para LOGIN_REQUEST_EXT, rechazar resp -> ngroups fuera del rango con signo [0, NGROUPS_MAX] de antemano y reportar el error desde ipc_validate_msg() para que se active en el l\u00edmite IPC; con ese l\u00edmite la multiplicaci\u00f3n y suma subsiguientes se mantienen muy por debajo de UINT_MAX. La comprobaci\u00f3n de ngroups ahora redundante y pr_err en ksmbd_alloc_user() se eliminan.\n\nEste es el an\u00e1logo del lado de la respuesta de aab98e2dbd64 (\u2019ksmbd: corregir desbordamientos de entero en sistemas de 32 bits\u2019), que reforz\u00f3 el lado de la solicitud."}], "lastModified": "2026-11-11T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04651641-C387-4546-B02F-17BA989CC253", "versionEndExcluding": "6.12.84", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C", "versionEndExcluding": "6.18.25", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8", "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}