CVE-2026-31613 (GCVE-0-2026-31613)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-08-05 12:23
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server. symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset 0. When the server-controlled ErrorDataLength advances p to within 1-7 bytes of end, the next iteration will read past it. When the matching context is found, sym->SymLinkErrorTag is read at offset 4 from p->ErrorContextData with no check that the symlink header itself fits. smb2_parse_symlink_response() then bounds-checks the substitute name using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from iov_base. That value is computed as sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), which is correct only when ErrorContextCount == 0. With at least one error context the symlink data sits 8 bytes deeper, and each skipped non-matching context shifts it further by 8 + ALIGN(ErrorDataLength, 8). The check is too short, allowing the substitute name read to run past iov_len. The out-of-bound heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2). Fix this all up by making the loops test require the full context header to fit, rejecting sym if its header runs past end, and bound the substitute name against the actual position of sym->PathBuffer rather than a fixed offset. Because sub_offs and sub_len are 16bits, the pointer math will not overflow here with the new greater-than.
References
Impacted products
Vendor Product Version
Linux Linux Version: 76894f3e2f71177747b8b4763fb180e800279585
Version: 76894f3e2f71177747b8b4763fb180e800279585
Version: 76894f3e2f71177747b8b4763fb180e800279585
Version: 76894f3e2f71177747b8b4763fb180e800279585
Version: 76894f3e2f71177747b8b4763fb180e800279585
Version: 76894f3e2f71177747b8b4763fb180e800279585
Version: 76894f3e2f71177747b8b4763fb180e800279585
Version: 2d046892a493d9760c35fdaefc3017f27f91b621
Version: 6.0.16   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "043834e72337ee7b4e9685859888623ba1504ac7",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "d65a64755a3df68a2fd19d2a81395e9f723aca23",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "20ac98f0eb6047edb73c9a27af782bdde08b3757",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "e0dd90d14cbbf318157ea8e3fb62ee68a28655ed",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "781902e069f4ecb6c3b83502f181972c1446110a",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "a66ef2e7ed837325c5600f8617d5ee0a0a149fdd",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "3df690bba28edec865cf7190be10708ad0ddd67e",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2d046892a493d9760c35fdaefc3017f27f91b621",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB reads parsing symlink error response\n\nWhen a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message()\nreturns success without any length validation, leaving the symlink\nparsers as the only defense against an untrusted server.\n\nsymlink_data() walks SMB 3.1.1 error contexts with the loop test \"p \u003c\nend\", but reads p-\u003eErrorId at offset 4 and p-\u003eErrorDataLength at offset\n0.  When the server-controlled ErrorDataLength advances p to within 1-7\nbytes of end, the next iteration will read past it.  When the matching\ncontext is found, sym-\u003eSymLinkErrorTag is read at offset 4 from\np-\u003eErrorContextData with no check that the symlink header itself fits.\n\nsmb2_parse_symlink_response() then bounds-checks the substitute name\nusing SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from\niov_base.  That value is computed as sizeof(smb2_err_rsp) +\nsizeof(smb2_symlink_err_rsp), which is correct only when\nErrorContextCount == 0.\n\nWith at least one error context the symlink data sits 8 bytes deeper,\nand each skipped non-matching context shifts it further by 8 +\nALIGN(ErrorDataLength, 8).  The check is too short, allowing the\nsubstitute name read to run past iov_len.  The out-of-bound heap bytes\nare UTF-16-decoded into the symlink target and returned to userspace via\nreadlink(2).\n\nFix this all up by making the loops test require the full context header\nto fit, rejecting sym if its header runs past end, and bound the\nsubstitute name against the actual position of sym-\u003ePathBuffer rather\nthan a fixed offset.\n\nBecause sub_offs and sub_len are 16bits, the pointer math will not\noverflow here with the new greater-than."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The crafted data is delivered over SMB by a remote SMB server in response to client CREATE/path-info operations. A malicious server can trigger the parser once the victim connects to or uses the share.\nAC:L - The attacker controls the relevant SMB error context fields, offsets, and lengths in a single response. No race or condition outside attacker control is required.\nPR:N - The attacker needs no privileges on the victim system; they only need to operate or impersonate the SMB server endpoint. SMB session setup is victim-side interaction, not attacker privilege.\nUI:R - A victim must mount/connect to the SMB share or access a path on an already-mounted share. The server cannot trigger the vulnerable client path without such client activity.\nS:U - The bug affects the kernel SMB client and exposes or disrupts resources within the same client security authority. It does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The malformed symlink error response can make kernel heap bytes past the received SMB buffer get UTF-16 decoded into the symlink target and returned to userspace. The over-read is not strictly limited to only a few bytes in the error-context case.\nI:N - The bug is an out-of-bounds read, not a write or control-flow primitive. The malicious server already controls symlink response contents, so this adds disclosure and possible crash impact rather than data modification.\nA:H - The unchecked over-read occurs in kernel parsing/conversion paths and can read beyond the allocated receive buffer, which can fault or oops the kernel. A malicious server can also repeatedly trigger the malformed response when the client accesses the path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:51.182Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/043834e72337ee7b4e9685859888623ba1504ac7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d65a64755a3df68a2fd19d2a81395e9f723aca23"
        },
        {
          "url": "https://git.kernel.org/stable/c/20ac98f0eb6047edb73c9a27af782bdde08b3757"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0dd90d14cbbf318157ea8e3fb62ee68a28655ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/781902e069f4ecb6c3b83502f181972c1446110a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a66ef2e7ed837325c5600f8617d5ee0a0a149fdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/3df690bba28edec865cf7190be10708ad0ddd67e"
        }
      ],
      "title": "smb: client: fix OOB reads parsing symlink error response",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31613",
    "datePublished": "2026-04-24T14:42:33.453Z",
    "dateReserved": "2026-03-09T15:48:24.123Z",
    "dateUpdated": "2026-08-05T12:23:51.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.