CVE-2026-31705 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-31705 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-31705 is a critical out-of-bounds write vulnerability in the Linux kernel's ksmbd component, specifically within the SMB2 extended attributes (EA) handling function smb2_get_ea().

Technical Detail

The flaw arises in smb2_get_ea() when 4-byte alignment padding is applied via memset() after writing EA data; insufficient bounds checking allows the write operation to exceed the intended buffer boundary. An attacker with access to the ksmbd SMB2 server, which may be reachable over the network without authentication depending on share configuration, could craft a malicious SMB2 request that triggers this condition. Successful exploitation could result in kernel memory corruption, potentially leading to privilege escalation or remote code execution in the context of the kernel.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, meaning no public proof-of-concept or operational exploit has been confirmed as of May 08, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence.

What To Do

Apply the relevant Linux kernel patch addressing this vulnerability as soon as it becomes available through your distribution's security channel. Given the critical CVSS score of 9.8 and the network-accessible attack surface of ksmbd, patching should be treated as high priority. As an interim workaround, administrators who do not require the ksmbd in-kernel SMB server should disable or unload the ksmbd module to eliminate exposure. Organizations running ksmbd in production should monitor kernel security advisories from their distribution vendors, including Red Hat, Ubuntu, SUSE, and Debian, for backported fixes. Detection efforts should focus on anomalous SMB2 traffic and unexpected kernel panics or memory corruption indicators on systems running ksmbd.