Answer in brief
CVE-2026-31709 records a High severity (CVSS 8.8) vulnerability in smb: client: validate the whole DACL before rewriting it in cifsacl. The current sources do not mark it as known exploited. The current feed maps Red Hat/kernel-rt (generic), Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/kernel-rt (generic), Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/kernel-rtgeneric | * | Not reported |
| Linux/Linuxgeneric | >=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <b8603d9ae6c9087662b098619996bc4a8064319d || >=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <c2abdebf72000a64603ced84d36ccbd164f11391 || >=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 || >=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <d92f3f0b22414e7515696a02224d0af55e3004a3 || >=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 || >=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <b78db9bddc84136f6a0bb49e8883cf200dfb87a8 || >=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 <0a8cf165566ba55a39fd0f4de172119dd646d39a | b8603d9ae6c9087662b098619996bc4a8064319d, c2abdebf72000a64603ced84d36ccbd164f11391, 8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12, d92f3f0b22414e7515696a02224d0af55e3004a3, ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5, b78db9bddc84136f6a0bb49e8883cf200dfb87a8, 0a8cf165566ba55a39fd0f4de172119dd646d39a |
| Linux/Linuxgeneric | 5.12 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL body. A malicious server can return a truncated DACL that still contains a header, claims one or more ACEs, and then drive replace_sids_and_copy_aces() or set_chmod_dacl() past the validated extent while they compare or copy attacker-controlled ACEs. Factor the DACL structural checks into validate_dacl(), extend them to validate each ACE against the DACL bounds, and use the shared validator before the chmod/chown rebuild paths. parse_dacl() reuses the same validator so the read-side parser and write-side rewrite paths agree on what constitutes a well-formed incoming DACL.
Quoted source text, attributed separately from HOL analysis.