{"id":"CVE-2026-31708","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n\nsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL\nand the default QUERY_INFO pa…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n\nsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL\nand the default QUERY_INFO pa…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cwe":["CWE-125"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.1, < 6.6.136","linux_kernel >= 6.7, < 6.12.84","linux_kernel >= 6.13, < 6.18.25","linux_kernel >= 6.19, < 7.0.2"],"patched":["linux_kernel 7.0.2"],"published":"2026-05-01","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:19.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31708","references":[{"url":"https://git.kernel.org/stable/c/078fae8f50adebb903ccf2252b44391324571e78","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1dd757379997b71a328a4b591ffaf481acd0ead1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85fd46ee26a11841c670449508025965f61ce131","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e203dbb5402897c43130fb171a2617008a91f45","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a34d456934fe42e4da5d2cc07787bf418bee99c6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac2f14e4705d020f04e806efa0d49ab8dc2b145f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e66bdc0704977ecee667a81d38255b579c2353d0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00307,"epssPercentile":0.21838,"ingestedAt":"2026-10-15T03:30:12.867Z","slug":"CVE-2026-31708","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n\nsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL\nand the default QUERY_INFO path.  The QUERY_INFO branch clamps\nqi.input_buffer_length to the server-reported OutputBufferLength and then\ncopies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but\nit never verifies that the flexible-array payload actually fits within\nrsp_iov[1].iov_len.\n\nA malicious server can return OutputBufferLength larger than the actual\nQUERY_INFO response, causing copy_to_user() to walk past the response\nbuffer and expose adjacent kernel heap to userspace.\n\nGuard the QUERY_INFO copy with a bounds check on the actual Buffer\npayload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)\nrather than an open-coded addition so the guard cannot overflow on\n32-bit builds.\n\n## Affected\n\n- `linux_kernel >= 5.1, < 6.6.136`\n- `linux_kernel >= 6.7, < 6.12.84`\n- `linux_kernel >= 6.13, < 6.18.25`\n- `linux_kernel >= 6.19, < 7.0.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.2`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}