8.8
HIGH
CVSS 3.1
CVE-2026-31709
smb: client: validate the whole DACL before rewriting it in cifsacl
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL body. A malicious server can return a truncated DACL that still contains a header, claims one or more ACEs, and then drive replace_sids_and_copy_aces() or set_chmod_dacl() past the validated extent while they compare or copy attacker-controlled ACEs. Factor the DACL structural checks into validate_dacl(), extend them to validate each ACE against the DACL bounds, and use the shared validator before the chmod/chown rebuild paths. parse_dacl() reuses the same validator so the read-side parser and write-side rewrite paths agree on what constitutes a well-formed incoming DACL.
Details
INFO
Published Date :
May 1, 2026, 2:16 p.m.
Last Modified :
Nov. 11, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products
The following products are affected by CVE-2026-31709
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | ||||
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
Solution
Validate DACL structure and ACEs to prevent out-of-bounds reads and writes.
- Apply the security update for the Linux kernel.
- Ensure DACL structural checks are implemented.
- Validate each ACE against DACL bounds.
- Use the shared validator for parser and rewrite paths.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31709.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31709 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31709
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31709 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31709 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Nov. 11, 2026
Action Type Old Value New Value Added Translation Title: Linux Kernel, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: smb: cliente: validar todo el DACL antes de reescribirlo en cifsacl build_sec_desc() e id_mode_to_cifs_acl() derivan un puntero DACL de un dacloffset proporcionado por el servidor y luego usan el ACL entrante para reconstruir el descriptor de seguridad chmod/chown. La corrección original solo verificaba que el encabezado de la estructura smb_acl encajara antes de leer dacl_ptr -> size o dacl_ptr -> num_aces. Eso evita la lectura OOB inmediata del campo de encabezado, pero los ayudantes de reescritura aún recorren los ACE basándose en pdacl -> num_aces sin validación estructural del cuerpo del DACL entrante. Un servidor malicioso puede devolver un DACL truncado que aún contiene un encabezado, reclama uno o más ACE, y luego impulsa replace_sids_and_copy_aces() o set_chmod_dacl() más allá del alcance validado mientras comparan o copian ACE controlados por el atacante. Factorizar las comprobaciones estructurales del DACL en validate_dacl(), extenderlas para validar cada ACE contra los límites del DACL, y usar el validador compartido antes de las rutas de reconstrucción de chmod/chown. parse_dacl() reutiliza el mismo validador para que el analizador del lado de lectura y las rutas de reescritura del lado de escritura estén de acuerdo sobre lo que constituye un DACL entrante bien formado. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 19, 2026
Action Type Old Value New Value Added CWE CWE-125 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 16, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-31709', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-16T15:12:47.844968Z'} -
CVE Modified by 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Oct. 15, 2026
Action Type Old Value New Value Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/31xxx/CVE-2026-31709.json">CVE-2026-31709</a> Added Reference https://cert-portal.siemens.com/productcert/html/ssa-784472.html -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Oct. 15, 2026
Action Type Old Value New Value Added Reference https://access.redhat.com/errata/RHSA-2026:21556 Added Reference https://access.redhat.com/errata/RHSA-2026:21706 Added Reference https://access.redhat.com/errata/RHSA-2026:21745 Added Reference https://access.redhat.com/errata/RHSA-2026:22900 Added Reference https://access.redhat.com/errata/RHSA-2026:22940 Added Reference https://access.redhat.com/errata/RHSA-2026:23224 Added Reference https://access.redhat.com/errata/RHSA-2026:23237 Added Reference https://access.redhat.com/errata/RHSA-2026:23329 Added Reference https://access.redhat.com/errata/RHSA-2026:24343 Added Reference https://access.redhat.com/security/cve/CVE-2026-31709 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2464476 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json Removed Reference https://access.redhat.com/errata/RHSA-2026:21556 Removed Reference https://access.redhat.com/errata/RHSA-2026:21706 Removed Reference https://access.redhat.com/errata/RHSA-2026:21745 Removed Reference https://access.redhat.com/errata/RHSA-2026:22900 Removed Reference https://access.redhat.com/errata/RHSA-2026:22940 Removed Reference https://access.redhat.com/errata/RHSA-2026:23224 Removed Reference https://access.redhat.com/errata/RHSA-2026:23237 Removed Reference https://access.redhat.com/errata/RHSA-2026:23329 Removed Reference https://access.redhat.com/errata/RHSA-2026:24343 Removed Reference https://access.redhat.com/security/cve/CVE-2026-31709 Removed Reference https://bugzilla.redhat.com/show_bug.cgi?id=2464476 Removed Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 15, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a Added Reference https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 Added Reference https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8 Added Reference https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d Added Reference https://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391 Added Reference https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3 Added Reference https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 Removed Reference https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a Removed Reference https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 Removed Reference https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8 Removed Reference https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d Removed Reference https://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391 Removed Reference https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3 Removed Reference https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 Removed Reference Type https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a Types: Patch Removed Reference Type https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8 Types: Patch -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 15, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.4::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.2::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus:9.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CRB (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat CodeReady Linux Builder EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux NFV (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.4::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux RT (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.4::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'versions': [{'status': 'unaffected', 'version': '0:6.12.0-211.20.1.el10_2', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10.0 Extended Update Support', 'versions': [{'status': 'unaffected', 'version': '0:6.12.0-55.77.1.el10_0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-553.126.1.rt7.467.el8_10', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-553.126.1.el8_10', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9', 'cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-687.12.1.el9_8', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-284.174.1.el9_2', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-284.174.1.rt14.459.el9_2', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.4'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-427.129.1.el9_4', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.6 Extended Update Support', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-570.119.1.el9_6', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.4::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.2::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus:9.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CRB (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat CodeReady Linux Builder EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux NFV (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.4::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux RT (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.4::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}] Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-1288 Added Reference https://access.redhat.com/errata/RHSA-2026:21556 Added Reference https://access.redhat.com/errata/RHSA-2026:21706 Added Reference https://access.redhat.com/errata/RHSA-2026:21745 Added Reference https://access.redhat.com/errata/RHSA-2026:22900 Added Reference https://access.redhat.com/errata/RHSA-2026:22940 Added Reference https://access.redhat.com/errata/RHSA-2026:23224 Added Reference https://access.redhat.com/errata/RHSA-2026:23237 Added Reference https://access.redhat.com/errata/RHSA-2026:23329 Added Reference https://access.redhat.com/errata/RHSA-2026:24343 Added Reference https://access.redhat.com/security/cve/CVE-2026-31709 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2464476 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d Added Reference https://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': '8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'd92f3f0b22414e7515696a02224d0af55e3004a3', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'b78db9bddc84136f6a0bb49e8883cf200dfb87a8', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': '0a8cf165566ba55a39fd0f4de172119dd646d39a', 'versionType': 'git'}], 'programFiles': ['fs/smb/client/cifsacl.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.86', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.2', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/client/cifsacl.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'b8603d9ae6c9087662b098619996bc4a8064319d', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'c2abdebf72000a64603ced84d36ccbd164f11391', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': '8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'd92f3f0b22414e7515696a02224d0af55e3004a3', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'b78db9bddc84136f6a0bb49e8883cf200dfb87a8', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': '0a8cf165566ba55a39fd0f4de172119dd646d39a', 'versionType': 'git'}], 'programFiles': ['fs/smb/client/cifsacl.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.86', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.2', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/client/cifsacl.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': '8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'd92f3f0b22414e7515696a02224d0af55e3004a3', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': 'b78db9bddc84136f6a0bb49e8883cf200dfb87a8', 'versionType': 'git'}, {'status': 'affected', 'version': 'bc3e9dd9d104ca1b75644eab87b38ce8a924aef4', 'lessThan': '0a8cf165566ba55a39fd0f4de172119dd646d39a', 'versionType': 'git'}], 'programFiles': ['fs/smb/client/cifsacl.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.86', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.2', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/client/cifsacl.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 09, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 17, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 07, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3 -
Initial Analysis by [email protected]
May. 06, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.12 up to (excluding) 7.0.2 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 03, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 01, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL body. A malicious server can return a truncated DACL that still contains a header, claims one or more ACEs, and then drive replace_sids_and_copy_aces() or set_chmod_dacl() past the validated extent while they compare or copy attacker-controlled ACEs. Factor the DACL structural checks into validate_dacl(), extend them to validate each ACE against the DACL bounds, and use the shared validator before the chmod/chown rebuild paths. parse_dacl() reuses the same validator so the read-side parser and write-side rewrite paths agree on what constitutes a well-formed incoming DACL. Added Reference https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a Added Reference https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.