CVE-2026-31478
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| f2283680a80571ca82d710bc6ecd8f8beac67d63 | affected | git | 70b4c414889492c522b6e4331562360f49be2361 | Unavailable | None listed |
| 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 | affected | git | 9a7166f0ef8cbb7bb48dd05e2471d995566003f5 | Unavailable | None listed |
| e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d | affected | git | c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683 | Unavailable | None listed |
| e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d | affected | git | 6aef1765d6807e0f027cd87f6ac973eb0879a46d | Unavailable | None listed |
| e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d | affected | git | 80824c7e527b70cf9039534e60aff592e8f209d1 | Unavailable | None listed |
| e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d | affected | git | 4cb537ae4f37d7d0f617815ed4bed7173fb50861 | Unavailable | None listed |
| e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d | affected | git | 0e55f63dd08f09651d39e1b709a91705a8a0ddcb | Unavailable | None listed |
| 5.15.145 | affected | semver | 5.15.203 | Unavailable | None listed |
| 6.1.71 | affected | semver | 6.1.168 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.6 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.6 | Unavailable | None listed |
| 5.15.203 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.168 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.131 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.80 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.21 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19.11 | unaffected | semver | Unavailable | 6.19.* | None listed |
| 7.0 | unaffected | original_commit_for_fix | Unavailable | * | None listed |