CVE-2026-31704Medium· 5.5▾ Sunlit

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use check_add_overflow() to prevent u16 DACL size overflow set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use check_add_overflow() to prevent u16 DACL size overflow set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables. When a file …

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score30/ 100 · Low

impact 30.3 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 1, 2026

Updated

Oct 15, 2026

CVSS

5.5

Vendor

linux

Product

linux_kernel

CWE

—

Depth score

30 · Low

EPSS

0.16% · p5

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 167 days

May 1, 2026Published
Disclosed via NVD
Oct 15, 2026Record revised
Last analysed / modified upstream
Oct 15, 2026EPSS first tracked
0.2%

linux #nvd

Affected

linux_kernel >= 5.15, < 6.6.136
linux_kernel >= 6.7, < 6.12.84
linux_kernel >= 6.13, < 6.18.25
linux_kernel >= 6.19, < 7.0.2

Patched in

linux_kernel 7.0.2

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use check_add_overflow() to prevent u16 DACL size overflow

set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causing the pointer arithmetic (char *)pndace + *size to land within already-written ACEs. Subsequent writes then overwrite earlier entries, and pndacl->size gets a truncated value.

Use check_add_overflow() at each accumulation point to detect the wrap before it corrupts the buffer, consistent with existing check_mul_overflow() usage elsewhere in smbacl.c.

Affected

linux_kernel >= 5.15, < 6.6.136
linux_kernel >= 6.7, < 6.12.84
linux_kernel >= 6.13, < 6.18.25
linux_kernel >= 6.19, < 7.0.2

Remediation

Upgrade past the affected range:

linux_kernel 7.0.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd