GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31478 (GCVE-0-2026-31478)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-08-05 12:22
VLAI
Title
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f2283680a80571ca82d710bc6ecd8f8beac67d63 , < 70b4c414889492c522b6e4331562360f49be2361 (git)
Affected: 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 , < 9a7166f0ef8cbb7bb48dd05e2471d995566003f5 (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683 (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 6aef1765d6807e0f027cd87f6ac973eb0879a46d (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 80824c7e527b70cf9039534e60aff592e8f209d1 (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 4cb537ae4f37d7d0f617815ed4bed7173fb50861 (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 0e55f63dd08f09651d39e1b709a91705a8a0ddcb (git)
Affected: 5.15.145 , < 5.15.203 (semver)
Affected: 6.1.71 , < 6.1.168 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.6.131 , ≤ 6.6.* (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "70b4c414889492c522b6e4331562360f49be2361",
              "status": "affected",
              "version": "f2283680a80571ca82d710bc6ecd8f8beac67d63",
              "versionType": "git"
            },
            {
              "lessThan": "9a7166f0ef8cbb7bb48dd05e2471d995566003f5",
              "status": "affected",
              "version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77",
              "versionType": "git"
            },
            {
              "lessThan": "c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "6aef1765d6807e0f027cd87f6ac973eb0879a46d",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "80824c7e527b70cf9039534e60aff592e8f209d1",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "4cb537ae4f37d7d0f617815ed4bed7173fb50861",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "0e55f63dd08f09651d39e1b709a91705a8a0ddcb",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.203",
              "status": "affected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.168",
              "status": "affected",
              "version": "6.1.71",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15.145",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "6.1.71",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()\n\nAfter this commit (e2b76ab8b5c9 \"ksmbd: add support for read compound\"),\nresponse buffer management was changed to use dynamic iov array.\nIn the new design, smb2_calc_max_out_buf_len() expects the second\nargument (hdr2_len) to be the offset of -\u003eBuffer field in the\nresponse structure, not a hardcoded magic number.\nFix the remaining call sites to use the correct offsetof() value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in ksmbd SMB2 request handling reachable over TCP SMB connections, including normal network-facing port 445 deployments.\nAC:L - An attacker controls the SMB2 compound request layout, output buffer lengths, and command sequence needed to reach the miscalculation; no race or external timing condition is required.\nPR:N - The handlers run after SMB session/tree setup, but ksmbd supports guest/anonymous sessions and guest shares, so a reasonable deployment allows a remote attacker to reach the path without credentials.\nUI:N - No victim action is required after the ksmbd service is exposed; the attacker sends crafted SMB2 requests directly.\nS:U - The impact remains within the kernel/ksmbd security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The bug can cause out-of-bounds kernel response-buffer memory corruption in compound SMB2 handling, which is defensibly treatable as exploitable memory corruption with potential information disclosure.\nI:H - The incorrect length calculation can permit an out-of-bounds write past the ksmbd response buffer, and kernel OOB writes are scored as high integrity impact.\nA:H - Even if not weaponized for code execution, the out-of-bounds kernel write can crash or oops the kernel, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:57.123Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/70b4c414889492c522b6e4331562360f49be2361"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a7166f0ef8cbb7bb48dd05e2471d995566003f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aef1765d6807e0f027cd87f6ac973eb0879a46d"
        },
        {
          "url": "https://git.kernel.org/stable/c/80824c7e527b70cf9039534e60aff592e8f209d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cb537ae4f37d7d0f617815ed4bed7173fb50861"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e55f63dd08f09651d39e1b709a91705a8a0ddcb"
        }
      ],
      "title": "ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31478",
    "datePublished": "2026-04-22T13:54:06.157Z",
    "dateReserved": "2026-03-09T15:48:24.098Z",
    "dateUpdated": "2026-08-05T12:22:57.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31478",
      "date": "2026-09-16",
      "epss": "0.00502",
      "percentile": "0.41752"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-01T01:39:24.000Z",
      "cve": "CVE-2026-31478",
      "id": "msrc_CVE-2026-31478",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31478.json",
      "version": "7"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31478\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-22T14:16:44.630\",\"lastModified\":\"2026-06-17T10:33:49.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()\\n\\nAfter this commit (e2b76ab8b5c9 \\\"ksmbd: add support for read compound\\\"),\\nresponse buffer management was changed to use dynamic iov array.\\nIn the new design, smb2_calc_max_out_buf_len() expects the second\\nargument (hdr2_len) to be the offset of -\u003eBuffer field in the\\nresponse structure, not a hardcoded magic number.\\nFix the remaining call sites to use the correct offsetof() value.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f2283680a80571ca82d710bc6ecd8f8beac67d63\",\"lessThan\":\"70b4c414889492c522b6e4331562360f49be2361\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f297df20d93411c0b4ddad7f88ba04a7cd36e77\",\"lessThan\":\"9a7166f0ef8cbb7bb48dd05e2471d995566003f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"6aef1765d6807e0f027cd87f6ac973eb0879a46d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"80824c7e527b70cf9039534e60aff592e8f209d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"4cb537ae4f37d7d0f617815ed4bed7173fb50861\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"0e55f63dd08f09651d39e1b709a91705a8a0ddcb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.145\",\"lessThan\":\"5.15.203\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.71\",\"lessThan\":\"6.1.168\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.168\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.131\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.80\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.21\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.11\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.145\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"120A3FBD-C86A-46F6-BD23-D862D4C6E574\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.71\",\"versionEndExcluding\":\"6.1.168\",\"matchCriteriaId\":\"C6118D40-41D5-46EF-9C28-382159147BC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.1\",\"versionEndExcluding\":\"6.6.131\",\"matchCriteriaId\":\"3EA624E3-2F2A-4DB3-B19B-6DE1E6D1BEA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.80\",\"matchCriteriaId\":\"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.21\",\"matchCriteriaId\":\"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.11\",\"matchCriteriaId\":\"4CA2E747-A9EC-4518-9AA2-B4247FC748B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"E346B162-D566-4E62-ABDE-ECBFB21B8BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e55f63dd08f09651d39e1b709a91705a8a0ddcb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4cb537ae4f37d7d0f617815ed4bed7173fb50861\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6aef1765d6807e0f027cd87f6ac973eb0879a46d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70b4c414889492c522b6e4331562360f49be2361\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/80824c7e527b70cf9039534e60aff592e8f209d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a7166f0ef8cbb7bb48dd05e2471d995566003f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:25:39+00:00",
      "cve": "CVE-2026-31478",
      "id": "CVE-2026-31478",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31478.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-06T01:24:55Z",
      "cve": "CVE-2026-31478",
      "id": "CVE-2026-31478",
      "initial_release_date": "2026-04-23T01:25:44Z",
      "product_status:known_not_affected": "315",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31478",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31478.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.