GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31705 (GCVE-0-2026-31705)

Vulnerability from cvelistv5 – Published: 2026-05-01 13:56 – Updated: 2026-08-05 12:24
VLAI
Title
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward with no check on remaining space. When the EA value exactly fills the remaining buffer (buf_free_len == 0 after value subtraction), the alignment memset writes 1-3 NUL bytes past the buf_free_len boundary. In compound requests where the response buffer is shared across commands, the first command (e.g., READ) can consume most of the buffer, leaving a tight remainder for the QUERY_INFO EA response. The alignment memset then overwrites past the physical kvmalloc allocation into adjacent kernel heap memory. Add a bounds check before the alignment memset to ensure buf_free_len can accommodate the padding bytes. This is the same bug pattern fixed by commit beef2634f81f ("ksmbd: fix potencial OOB in get_file_all_info() for compound requests") and commit fda9522ed6af ("ksmbd: fix OOB write in QUERY_INFO for compound requests"), both of which added bounds checks before unconditional writes in QUERY_INFO response handlers.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 , < ddbbc8b2a09dd2cfed90871313e3691ae1db08a2 (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < ffbce350c6fd1e99116ea57383b9031717e36d3b (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 98f3de6ef4efbd899348d333f0902dc4ff14380c (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 790304c02bf9bd7b8171feda4294d6e62d32ae8f (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 922d48fe8c19f388ffa2f709f33acaae4e408de2 (git)
Affected: e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d , < 30010c952077a1c89ecdd71fc4d574c75a8f5617 (git)
Affected: f2283680a80571ca82d710bc6ecd8f8beac67d63 (git)
Affected: 6.1.71 , < 6.1.175 (semver)
Affected: 5.15.145 , < 5.16 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.136 , ≤ 6.6.* (semver)
Unaffected: 6.12.84 , ≤ 6.12.* (semver)
Unaffected: 6.18.25 , ≤ 6.18.* (semver)
Unaffected: 7.0.2 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ddbbc8b2a09dd2cfed90871313e3691ae1db08a2",
              "status": "affected",
              "version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77",
              "versionType": "git"
            },
            {
              "lessThan": "ffbce350c6fd1e99116ea57383b9031717e36d3b",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "98f3de6ef4efbd899348d333f0902dc4ff14380c",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "790304c02bf9bd7b8171feda4294d6e62d32ae8f",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "922d48fe8c19f388ffa2f709f33acaae4e408de2",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "lessThan": "30010c952077a1c89ecdd71fc4d574c75a8f5617",
              "status": "affected",
              "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f2283680a80571ca82d710bc6ecd8f8beac67d63",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.175",
              "status": "affected",
              "version": "6.1.71",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.145",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.1.71",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.84",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.25",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.145",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\n\nsmb2_get_ea() applies 4-byte alignment padding via memset() after\nwriting each EA entry. The bounds check on buf_free_len is performed\nbefore the value memcpy, but the alignment memset fires unconditionally\nafterward with no check on remaining space.\n\nWhen the EA value exactly fills the remaining buffer (buf_free_len == 0\nafter value subtraction), the alignment memset writes 1-3 NUL bytes\npast the buf_free_len boundary. In compound requests where the response\nbuffer is shared across commands, the first command (e.g., READ) can\nconsume most of the buffer, leaving a tight remainder for the QUERY_INFO\nEA response. The alignment memset then overwrites past the physical\nkvmalloc allocation into adjacent kernel heap memory.\n\nAdd a bounds check before the alignment memset to ensure buf_free_len\ncan accommodate the padding bytes.\n\nThis is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix\npotencial OOB in get_file_all_info() for compound requests\") and\ncommit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound\nrequests\"), both of which added bounds checks before unconditional\nwrites in QUERY_INFO response handlers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd processes SMB2 requests over TCP, typically port 445, and the vulnerable `SMB2_QUERY_INFO` EA path is reachable through network packets from a remote SMB client.\nAC:L - The attacker can craft the compound response-buffer exhaustion and EA length/alignment conditions through SMB requests and controlled xattr sizes; there is no race or external condition beyond attacker control.\nPR:N - Although `SMB2_QUERY_INFO` is after session and tree setup, ksmbd supports guest/anonymous sessions and guest-accessible shares, so a reasonable deployment can expose this path without authenticated credentials.\nUI:N - No victim action is required after the server is running and exposing the share; the attacker sends SMB requests directly.\nS:U - The corruption occurs inside the kernel SMB server and impacts the same kernel/host security authority, without crossing a VM, IOMMU, or sandbox boundary.\nC:H - This is kernel heap memory corruption from an out-of-bounds write; in the highest defensible case it can be leveraged toward kernel code execution or primitives that expose arbitrary kernel data.\nI:H - The bug is an out-of-bounds write of attacker-reached data into adjacent kernel heap memory, which is high integrity impact under the kernel scoring guidance.\nA:H - The out-of-bounds heap write can corrupt kernel memory and crash or panic the system, and it can be triggered remotely and repeatedly through SMB."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:39.919Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ddbbc8b2a09dd2cfed90871313e3691ae1db08a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c"
        },
        {
          "url": "https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2"
        },
        {
          "url": "https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617"
        }
      ],
      "title": "ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31705",
    "datePublished": "2026-05-01T13:56:03.896Z",
    "dateReserved": "2026-03-09T15:48:24.132Z",
    "dateUpdated": "2026-08-05T12:24:39.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31705",
      "date": "2026-09-16",
      "epss": "0.00389",
      "percentile": "0.32641"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-04T14:40:30.000Z",
      "cve": "CVE-2026-31705",
      "id": "msrc_CVE-2026-31705",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31705.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31705\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T14:16:20.473\",\"lastModified\":\"2026-06-17T10:34:16.650\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\\n\\nsmb2_get_ea() applies 4-byte alignment padding via memset() after\\nwriting each EA entry. The bounds check on buf_free_len is performed\\nbefore the value memcpy, but the alignment memset fires unconditionally\\nafterward with no check on remaining space.\\n\\nWhen the EA value exactly fills the remaining buffer (buf_free_len == 0\\nafter value subtraction), the alignment memset writes 1-3 NUL bytes\\npast the buf_free_len boundary. In compound requests where the response\\nbuffer is shared across commands, the first command (e.g., READ) can\\nconsume most of the buffer, leaving a tight remainder for the QUERY_INFO\\nEA response. The alignment memset then overwrites past the physical\\nkvmalloc allocation into adjacent kernel heap memory.\\n\\nAdd a bounds check before the alignment memset to ensure buf_free_len\\ncan accommodate the padding bytes.\\n\\nThis is the same bug pattern fixed by commit beef2634f81f (\\\"ksmbd: fix\\npotencial OOB in get_file_all_info() for compound requests\\\") and\\ncommit fda9522ed6af (\\\"ksmbd: fix OOB write in QUERY_INFO for compound\\nrequests\\\"), both of which added bounds checks before unconditional\\nwrites in QUERY_INFO response handlers.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9f297df20d93411c0b4ddad7f88ba04a7cd36e77\",\"lessThan\":\"ddbbc8b2a09dd2cfed90871313e3691ae1db08a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"ffbce350c6fd1e99116ea57383b9031717e36d3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"98f3de6ef4efbd899348d333f0902dc4ff14380c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"790304c02bf9bd7b8171feda4294d6e62d32ae8f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"922d48fe8c19f388ffa2f709f33acaae4e408de2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d\",\"lessThan\":\"30010c952077a1c89ecdd71fc4d574c75a8f5617\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2283680a80571ca82d710bc6ecd8f8beac67d63\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.71\",\"lessThan\":\"6.1.175\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.145\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.136\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.84\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.25\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.2\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.145\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"B98C9201-BF17-4E2C-84FF-75EE2AA94DC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.71\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"163E72B5-0F5D-49E2-AAEA-F11E02D730AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.136\",\"matchCriteriaId\":\"D1C8822E-08AF-49C3-8A31-F806E5FAE5E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.84\",\"matchCriteriaId\":\"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.25\",\"matchCriteriaId\":\"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.2\",\"matchCriteriaId\":\"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ddbbc8b2a09dd2cfed90871313e3691ae1db08a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:27:40+00:00",
      "cve": "CVE-2026-31705",
      "id": "CVE-2026-31705",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31705.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:23:40Z",
      "cve": "CVE-2026-31705",
      "id": "CVE-2026-31705",
      "initial_release_date": "2026-05-02T01:25:26Z",
      "product_status:known_not_affected": "291",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31705",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31705.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.