{"id":"CVE-2026-31704","revision":"8c6bf4f3c4b04cb59568d418cbd4ec95","records":[{"revision":"8c6bf4f3c4b04cb59568d418cbd4ec95","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31704","aliases":[],"title":"ksmbd: use check_add_overflow() to prevent u16 DACL size overflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use check_add_overflow() to prevent u16 DACL size overflow\n\nset_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes\nin u16 variables. When a file has many POSIX ACL entries, the\naccumulated size can wrap past 65535, causing the pointer arithmetic\n(char *)pndace + *size to land within already-written ACEs. Subsequent\nwrites then overwrite earlier entries, and pndacl->size gets a\ntruncated value.\n\nUse check_add_overflow() at each accumulation point to detect the\nwrap before it corrupts the buffer, consistent with existing\ncheck_mul_overflow() usage elsewhere in smbacl.c.","state":0,"publishedAt":"2026-05-01T13:56:03.243+00:00","modifiedAt":"2026-10-15T01:18:01.953+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/server/smbacl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"41e53a773db6342ac9a689ee5ba635c31744c9f0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"8d5729350b236896f51379588d9a690b7fafb8db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"e1955a94b6f17f4b058afa955a6f187eb3ed7615\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"299f962c0b02d048fb45d248b4da493d03f3175d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/server/smbacl.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.175\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.136\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.84\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.25\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.2\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/41e53a773db6342ac9a689ee5ba635c31744c9f0","https://git.kernel.org/stable/c/8d5729350b236896f51379588d9a690b7fafb8db","https://git.kernel.org/stable/c/e1955a94b6f17f4b058afa955a6f187eb3ed7615","https://git.kernel.org/stable/c/5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43","https://git.kernel.org/stable/c/ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7","https://git.kernel.org/stable/c/299f962c0b02d048fb45d248b4da493d03f3175d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31704","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31704","identifiers":["CVE-2026-31704"]},"retained":false,"historicalAffected":[]}],"coverage":[]}