CVE-2026-31478
Published: 22 April 2026
Summary
CVE-2026-31478 is a critical-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31478 is a vulnerability in the Linux kernel's ksmbd module, which implements SMB server functionality. The issue arises in the smb2_calc_max_out_buf_len() function, where a hardcoded hdr2_len value is used instead of the correct offsetof() macro to calculate the offset of the ->Buffer field in response structures. This bug was introduced after commit e2b76ab8b5c9, which updated response buffer management to use a dynamic iov array for read compound support, and it affects call sites that were not updated accordingly.
The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges or user interaction required. A remote unauthenticated attacker can leverage flawed buffer length calculations in ksmbd's SMB2 response handling to achieve high-impact confidentiality, integrity, and availability effects, potentially leading to remote code execution or system compromise on affected kernel instances exposing the SMB service.
Mitigation requires updating to a patched Linux kernel version incorporating the fix. Relevant stable kernel patches are available at git.kernel.org, including commits such as 0e55f63dd08f09651d39e1b709a91705a8a0ddcb, 4cb537ae4f37d7d0f617815ed4bed7173fb50861, 6aef1765d6807e0f027cd87f6ac973eb0879a46d, 70b4c414889492c522b6e4331562360f49be2361, and 80824c7e527b70cf9039534e60aff592e8f209d1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24835
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the…
more
new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote RCE in public-facing ksmbd SMB server directly enables T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, prioritization, and remediation of the ksmbd buffer length calculation flaw via kernel patches to prevent remote exploitation.
Prohibits or restricts unnecessary kernel modules like ksmbd, eliminating exposure to the SMB2 response buffer miscalculation vulnerability.
Monitors and controls network communications to the SMB port (445), restricting remote unauthenticated access that could exploit the flawed buffer length calculations.