---
id: CVE-2026-31708
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

  smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL
  and the default QUERY_INFO pa…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

  smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL
  and the default QUERY_INFO pa…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H'
cwe:
  - CWE-125
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.1, < 6.6.136'
  - 'linux_kernel >= 6.7, < 6.12.84'
  - 'linux_kernel >= 6.13, < 6.18.25'
  - 'linux_kernel >= 6.19, < 7.0.2'
patched:
  - linux_kernel 7.0.2
published: '2026-05-01'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:19.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31708'
references:
  - url: 'https://git.kernel.org/stable/c/078fae8f50adebb903ccf2252b44391324571e78'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1dd757379997b71a328a4b591ffaf481acd0ead1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/85fd46ee26a11841c670449508025965f61ce131'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9e203dbb5402897c43130fb171a2617008a91f45'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a34d456934fe42e4da5d2cc07787bf418bee99c6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ac2f14e4705d020f04e806efa0d49ab8dc2b145f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e66bdc0704977ecee667a81d38255b579c2353d0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00307
epssPercentile: 0.21838
ingestedAt: '2026-10-15T03:30:12.867Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL
and the default QUERY_INFO path.  The QUERY_INFO branch clamps
qi.input_buffer_length to the server-reported OutputBufferLength and then
copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but
it never verifies that the flexible-array payload actually fits within
rsp_iov[1].iov_len.

A malicious server can return OutputBufferLength larger than the actual
QUERY_INFO response, causing copy_to_user() to walk past the response
buffer and expose adjacent kernel heap to userspace.

Guard the QUERY_INFO copy with a bounds check on the actual Buffer
payload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)
rather than an open-coded addition so the guard cannot overflow on
32-bit builds.

## Affected

- `linux_kernel >= 5.1, < 6.6.136`
- `linux_kernel >= 6.7, < 6.12.84`
- `linux_kernel >= 6.13, < 6.18.25`
- `linux_kernel >= 6.19, < 7.0.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.2`