{"id":"CVE-2026-31611","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require 3 sub-authorities before reading sub_auth[2]\n\nparse_dacl() compares each ACE SID against sid_unix_NFS_mode and on\nmatch reads sid.sub_auth[2] as the file…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require 3 sub-authorities before reading sub_auth[2]\n\nparse_dacl() compares each ACE SID against sid_unix_NFS_mode and on\nmatch reads sid.sub_auth[2] as the file…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.15, < 6.6.136","linux_kernel >= 6.7, < 6.12.83","linux_kernel >= 6.13, < 6.18.24","linux_kernel >= 6.19, < 6.19.14","linux_kernel >= 7.0, < 7.0.1"],"patched":["linux_kernel 7.0.1"],"published":"2026-04-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:12.263","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31611","references":[{"url":"https://git.kernel.org/stable/c/08f9e6d899b5c834bbcc239eae1bed58d9b15d2c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46bbcd3ebfb3549c8da1838fc4493e79bd3241e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53370cf9090777774e07fd9a8ebce67c6cc333ab","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9401f86a224f37b50e6a3ccf1d46a70d5ef8af0a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5b5d5936a50497fb151c0b122899a6894721c2b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf2148b880fb7c0fcd727202dbc4fd5d6998b9c2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2454f4a002d08560a60f214f392e6491cf11560","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00524,"epssPercentile":0.4304,"ingestedAt":"2026-10-15T03:30:12.859Z","slug":"CVE-2026-31611","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require 3 sub-authorities before reading sub_auth[2]\n\nparse_dacl() compares each ACE SID against sid_unix_NFS_mode and on\nmatch reads sid.sub_auth[2] as the file mode.  If sid_unix_NFS_mode is\nthe prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares\nonly min(num_subauth, 2) sub-authorities so a client SID with\nnum_subauth = 2 and sub_auth = {88, 3} will match.\n\nIf num_subauth = 2 and the ACE is placed at the very end of the security\ndescriptor, sub_auth[2] will be  4 bytes past end_of_acl.  The\nout-of-band bytes will then be masked to the low 9 bits and applied as\nthe file's POSIX mode, probably not something that is good to have\nhappen.\n\nFix this up by forcing the SID to actually carry a third sub-authority\nbefore reading it at all.\n\n## Affected\n\n- `linux_kernel >= 5.15, < 6.6.136`\n- `linux_kernel >= 6.7, < 6.12.83`\n- `linux_kernel >= 6.13, < 6.18.24`\n- `linux_kernel >= 6.19, < 6.19.14`\n- `linux_kernel >= 7.0, < 7.0.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.1`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}