{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d"
            },
            {
              "fixed": "850452af77f55d185f9445e1f7a1db53c5e4aad4"
            },
            {
              "fixed": "d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09"
            },
            {
              "fixed": "075ea208c648cc2bcd616295b711d3637c61de45"
            },
            {
              "fixed": "515c2daab46021221bdf406bef19bc90a44ec617"
            },
            {
              "fixed": "fda9522ed6afaec45cabc198d8492270c394c7bc"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "f2283680a80571ca82d710bc6ecd8f8beac67d63"
            },
            {
              "last_affected": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.15.145"
            },
            {
              "fixed": "5.16"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.1.71"
            },
            {
              "fixed": "6.2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.6.0"
            },
            {
              "fixed": "6.6.143"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.81"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.22"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "6.19.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31432.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning.",
  "id": "CVE-2026-31432",
  "modified": "2026-08-06T03:31:13.237327721Z",
  "published": "2026-04-22T08:15:10.873Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/850452af77f55d185f9445e1f7a1db53c5e4aad4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31432.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31432"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ksmbd: fix OOB write in QUERY_INFO for compound requests"
}