Technical Summary

The Linux kernel vulnerability CVE-2026-31611 involves the ksmbd SMB server component's parse_dacl() function, which compares Access Control Entry (ACE) Security Identifiers (SIDs) against a specific prefix (S-1-5-88-3) and reads the third sub-authority (sub_auth[2]) to determine file mode. The vulnerable code did not require the SID to have at least three sub-authorities before reading sub_auth[2], leading to an out-of-bounds read if the SID had only two sub-authorities. This out-of-bounds read could cause the file mode to be set based on unintended memory data, potentially impacting system behavior or security. The issue has been corrected by requiring the SID to have three sub-authorities before accessing sub_auth[2]. The vulnerability is rated with a CVSS 3.1 score of 8.6 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Multiple Linux kernel versions prior to 6.8.0 and related builds are affected. The vendor has released patches in updated kernel versions, and users should upgrade and reboot to apply the fix.