CVE Explorer

CVE-2026-31705

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memse

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a14bd3f31f838fd0de7a272c0fb2a5c5a70bd9e322dfb089b79f0b6e2e13b6ed

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ddbbc8b2a09dd2cfed90871313e3691ae1db08a2","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"ffbce350c6fd1e99116ea57383b9031717e36d3b","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"98f3de6ef4efbd899348d333f0902dc4ff14380c","status":"affected","version":"e2b76ab8b5c9327ab2dae6…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOr…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/metrics/0/cvssV3_1

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/ddbbc8b2a09dd2cfed90871313e3691ae1db08a2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:29a83bd1be0e7b3eac598502f6e84db5f4b7909807239e7cd6ed0f24ac7e3b37 · sha256:d321e5b916c3e96a… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer