Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as READ + QUERY_INFO(Security) is received, and the first command (READ) consumes most of the response buffer, ksmbd could write beyond the allocated buffer while building a security descriptor. The root cause was that smb2_get_info_sec() checked buffer space using ppntsd_size from xattr, while build_sec_desc() often synthesized a significantly larger descriptor from POSIX ACLs. This patch introduces smb_acl_sec_desc_scratch_len() to accurately compute the final descriptor size beforehand, performs proper buffer checking with smb2_calc_max_out_buf_len(), and uses exact-sized allocation + iov pinning.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
A new vulnerability with increased severity was disclosed for Linux Kernel (CVE-2026-31432) https://vuldb.com/vuln/358787
Post summary
A new Linux Kernel vulnerability (CVE‑2026‑31432) has been disclosed with increased severity, but no further technical details or mitigation information are provided.
🚨*CVE* CVE-2026-31432 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as READ + … https://www.cve.org/CVERecord?id=CVE-2026-31432 ----- Traducción: CVE-2026-31432 En … http://infoflow.cloud`
Post summary
The tweet reports that CVE‑2026‑31432, a Linux kernel out‑of‑bounds write in ksmbd’s QUERY_INFO during compound requests, has been fixed; no PoC, exploit, or active exploitation is mentioned.
CVE-2026-31432 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as READ + … https://www.cve.org/CVERecord?id=CVE-2026-31432
Post summary
The text announces that CVE‑2026‑31432, an OOB write vulnerability in ksmbd's QUERY_INFO handling for compound requests, has been fixed in the Linux kernel.
CVE-2026-31432 Out-of-Bounds Write in Linux Kernel ksmbd QUERY_INFO Compound Requests https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31432
Post summary
A new out-of-bounds write vulnerability in the Linux kernel's ksmbd component has been disclosed as CVE-2026-31432. No exploitation proof, active attacks, or patch information is provided.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |