CVE-2026-31708

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL

and the default QUERY_INFO path. The QUERY_INFO branch clamps

qi.input_buffer_length to the server-reported OutputBufferLength and then

copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but

it never verifies that the flexible-array payload actually fits within

rsp_iov[1].iov_len.

A malicious server can return OutputBufferLength larger than the actual

QUERY_INFO response, causing copy_to_user() to walk past the response

buffer and expose adjacent kernel heap to userspace.

Guard the QUERY_INFO copy with a bounds check on the actual Buffer

payload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)

rather than an open-coded addition so the guard cannot overflow on

32-bit builds.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References