CVE-2026-31704

About vulnerability

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use check_add_overflow() to prevent u16 DACL size overflow set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causing the pointer arithmetic (char *)pndace + *size to land within already-written ACEs. Subsequent writes then overwrite earlier entries, and pndacl->size gets a truncated value. Use check_add_overflow() at each accumulation point to detect the wrap before it corrupts the buffer, consistent with existing check_mul_overflow() usage elsewhere in smbacl.c. A flaw was found in the ksmbd component of the Linux kernel. This vulnerability arises from an integer overflow when handling Access Control List (ACL) sizes. When a file is configured with a large number of POSIX ACL entries, the system’s calculation of the accumulated size can exceed its designated memory, leading to incorrect pointer arithmetic. This can result in the corruption of the buffer, causing existing ACL entries to be overwritten and potentially leading to data integrity issues or system instability.

Live-patch status from KernelCare for each operating system.