CVE-2026-31614
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
smb: client: fix off-by-8 bounds check in check_wsl_eas()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA name and value, but ea_data sits at offset sizeof(struct smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp() later reads ea->ea_data[0..nlen-1] and the value bytes follow at ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1 + vlen. Isn't pointer math fun? The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the 8-byte header is in bounds, but since the last EA is placed within 8 bytes of the end of the response, the name and value bytes are read past the end of iov. Fix this mess all up by using ea->ea_data as the base for the bounds check. An "untrusted" server can use this to leak up to 8 bytes of kernel heap into the EA name comparison and influence which WSL xattr the data is interpreted as.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 7449d736bbbd160c76b01b8fcdf72f58a8757d4b | affected | git | bfbc74df8bbe095b3ed68f6d4487b368af087890 | Unavailable | None listed |
| ea41367b2a602f602ea6594fc4a310520dcc64f4 | affected | git | 5cc0574c84aa73946ade587c41e81757b8b01cb5 | Unavailable | None listed |
| ea41367b2a602f602ea6594fc4a310520dcc64f4 | affected | git | b2b76d09a64c538c57006180103fc1841e8cfa66 | Unavailable | None listed |
| ea41367b2a602f602ea6594fc4a310520dcc64f4 | affected | git | ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18 | Unavailable | None listed |
| ea41367b2a602f602ea6594fc4a310520dcc64f4 | affected | git | a893f1757d9a4009e4a8d7ceb2312142fe29cea4 | Unavailable | None listed |
| ea41367b2a602f602ea6594fc4a310520dcc64f4 | affected | git | 3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b | Unavailable | None listed |
| 6.6.32 | affected | semver | 6.6.136 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.9 | Unavailable | None listed |
| 6.6.136 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.83 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.24 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19.14 | unaffected | semver | Unavailable | 6.19.* | None listed |
| 7.0.1 | unaffected | semver | Unavailable | 7.0.* | None listed |
| 7.1 | unaffected | original_commit_for_fix | Unavailable | * | None listed |