CVE-2026-31707

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate response sizes in ipc_validate_msg() ipc_validate_msg() computes the expected message size for each response type by adding (or multiplying) attacker-controlled fields from the daemon response to a fixed struct size in unsigned int arithmetic. Three cases can overflow: KSMBD_EVENT_RPC_REQUEST: msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; KSMBD_EVENT_SHARE_CONFIG_REQUEST: msg_sz = sizeof(struct ksmbd_share_config_response) + resp->payload_sz; KSMBD_EVENT_LOGIN_REQUEST_EXT: msg_sz = sizeof(struct ksmbd_login_response_ext) + resp->ngroups * sizeof(gid_t); resp->payload_sz is __u32 and resp->ngroups is __s32. Each addition can wrap in unsigned int; the multiplication by sizeof(gid_t) mixes signed and size_t, so a negative ngroups is converted to SIZE_MAX before the multiply. A wrapped value of msg_sz that happens to equal entry->msg_sz bypasses the size check on the next line, and downstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz, kmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the unverified length. Use check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST paths to detect integer overflow without constraining functional payload size; userspace ksmbd-tools grows NDR responses in 4096-byte chunks for calls like NetShareEnumAll, so a hard transport cap is unworkable on the response side. For LOGIN_REQUEST_EXT, reject resp->ngroups outside the signed [0, NGROUPS_MAX] range up front and report the error from ipc_validate_msg() so it fires at the IPC boundary; with that bound the subsequent multiplication and addition stay well below UINT_MAX. The now-redundant ngroups check and pr_err in ksmbd_alloc_user() are removed. This is the response-side analogue of aab98e2dbd64 ("ksmbd: fix integer overflows on 32 bit systems"), which hardened the request side.

Severity

HIGH

CVSS score

7.1 (v3.1)

Vulnerability status

Modified

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-05-01 14:16:20.720000

Last modified

2026-10-30 13:18:42.847000

View original CVE JSON

{
  "id": "CVE-2026-31707",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-05-01T14:16:20.720",
  "lastModified": "2026-10-30T13:18:42.847",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate response sizes in ipc_validate_msg()\n\nipc_validate_msg() computes the expected message size for each\nresponse type by adding (or multiplying) attacker-controlled fields\nfrom the daemon response to a fixed struct size in unsigned int\narithmetic.  Three cases can overflow:\n\n  KSMBD_EVENT_RPC_REQUEST:\n      msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz;\n  KSMBD_EVENT_SHARE_CONFIG_REQUEST:\n      msg_sz = sizeof(struct ksmbd_share_config_response) +\n               resp->payload_sz;\n  KSMBD_EVENT_LOGIN_REQUEST_EXT:\n      msg_sz = sizeof(struct ksmbd_login_response_ext) +\n               resp->ngroups * sizeof(gid_t);\n\nresp->payload_sz is __u32 and resp->ngroups is __s32.  Each addition\ncan wrap in unsigned int; the multiplication by sizeof(gid_t) mixes\nsigned and size_t, so a negative ngroups is converted to SIZE_MAX\nbefore the multiply.  A wrapped value of msg_sz that happens to\nequal entry->msg_sz bypasses the size check on the next line, and\ndownstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz,\nkmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the\nunverified length.\n\nUse check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST\npaths to detect integer overflow without constraining functional\npayload size; userspace ksmbd-tools grows NDR responses in 4096-byte\nchunks for calls like NetShareEnumAll, so a hard transport cap is\nunworkable on the response side.  For LOGIN_REQUEST_EXT, reject\nresp->ngroups outside the signed [0, NGROUPS_MAX] range up front and\nreport the error from ipc_validate_msg() so it fires at the IPC\nboundary; with that bound the subsequent multiplication and addition\nstay well below UINT_MAX.  The now-redundant ngroups check and\npr_err in ksmbd_alloc_user() are removed.\n\nThis is the response-side analogue of aab98e2dbd64 (\"ksmbd: fix\ninteger overflows on 32 bit systems\"), which hardened the request\nside."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/smb/server/mgmt/user_config.c",
            "fs/smb/server/transport_ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "lessThan": "52518503a1a00bc33e9522c4eb05df023e3ae978",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "lessThan": "bf396208418371174869baba9434535cd3288e80",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "lessThan": "7dd0c858e1909769a4c91842724315ee74f1a5f1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "lessThan": "299db777ea0cfa5c407e41b045c24a14c034c27b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "lessThan": "99c631d0366c1eab8fb188fe66425f4581ebdde4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "lessThan": "d6a6aa81eac2c9bff66dc6e191179cb69a14426b",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/smb/server/mgmt/user_config.c",
            "fs/smb/server/transport_ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.15",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.141",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.84",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.25",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.0.2",
              "lessThanOrEqual": "7.0.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.15",
              "versionEndExcluding": "6.12.84",
              "matchCriteriaId": "04651641-C387-4546-B02F-17BA989CC253"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.18.25",
              "matchCriteriaId": "8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "7.0.2",
              "matchCriteriaId": "1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/52518503a1a00bc33e9522c4eb05df023e3ae978",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/bf396208418371174869baba9434535cd3288e80",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}