CVE-2026-31613 is a vulnerability in the Linux kernel SMB client subsystem where, upon receiving a CREATE response with STATUS_STOPPED_ON_SYMLINK, the smb2_check_message() function returns success without validating message length. This lack of validation allows the symlink parsers to be the sole defense against a malicious server. The symlink_data() function iterates over SMB 3.1.1 error contexts using a loop condition that can be bypassed due to server-controlled ErrorDataLength, causing out-of-bounds reads of error context fields. Additionally, smb2_parse_symlink_response() performs bounds checking based on fixed structure sizes that may not be accurate for all error contexts, further risking memory safety. This vulnerability can lead to out-of-bounds memory reads, potentially exposing sensitive information or causing denial of service. The issue affects Linux kernel versions prior to 6.8.0 and related variants. The vulnerability has a CVSS 3.1 score of 8.1 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. A patch is available and included in updated Linux kernel packages as per Ubuntu security advisories USN-8488-1 and USN-8488-2.

Successful exploitation can cause out-of-bounds memory reads in the SMB client when parsing symlink error responses, potentially exposing sensitive kernel memory or causing system instability (denial of service). The vulnerability has a high severity rating with a CVSS score of 8.1, indicating significant confidentiality and availability impacts. No known exploits in the wild have been reported at this time.

A patch is available and has been released in updated Linux kernel packages. Users should apply the relevant kernel updates and reboot their systems to ensure the vulnerability is remediated. Due to an ABI change in the kernel updates, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor guidance in the Ubuntu security notices USN-8488-1 and USN-8488-2 for detailed update instructions. No additional mitigations are specified or required beyond applying the official fix.