Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-31708

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fits within rsp_iov[1]
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:6f18b6083e85834f78f85a9608f5598a17254e5ee57551ff2f8d53da1e742810
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e66bdc0704977ecee667a81d38255b579c2353d0","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"9e203dbb5402897c43130fb171a2617008a91f45","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"1dd757379997b71a328a4b591ffaf481acd0ead1","status":"affected","version":"f5778c398713692a16150a…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessTha…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e66bdc0704977ecee667a81d38255b579c2353d0","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"9e203dbb5402897c43130fb171a2617008a91f45","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"1dd757379997b71a328a4b591ffaf481acd0ead1","status":"affected","version":"f5778c398713692a16150a…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessTha…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/078fae8f50adebb903ccf2252b44391324571e78"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/1dd757379997b71a328a4b591ffaf481acd0ead1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/85fd46ee26a11841c670449508025965f61ce131"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/9e203dbb5402897c43130fb171a2617008a91f45"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/a34d456934fe42e4da5d2cc07787bf418bee99c6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/ac2f14e4705d020f04e806efa0d49ab8dc2b145f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/e66bdc0704977ecee667a81d38255b579c2353d0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7fbb1efeb8f6d6ded2da38d6a811746a27b6d06246e87cbfe69d63ad7f8a26e8 · sha256:62430f1b1411ea7d… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer