CVE-2026-31433
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound request consists of QUERY_DIRECTORY + QUE...
Affects 2 products across 6 vendors.
Software reads data past the boundary of an allocated buffer, leaking sensitive information or causing crashes.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A vulnerability in the Linux kernel's ksmbd module could lead to an out-of-bounds write due to improper handling of compound requests involving QUERY_DIRECTORY and QUERY_INFO (FILE_ALL_INFORMATION) commands.
BSID: BS-2026-GLOBAL-271944-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-31433?
What is the CVSS score for CVE-2026-31433?
Is CVE-2026-31433 actively exploited?
How do I remediate CVE-2026-31433?
What systems are affected by CVE-2026-31433?
| CVE ID | CVE-2026-31433 |
|---|---|
| BSID | BS-2026-GLOBAL-271944-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-04-22 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound request consists of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) and the first command consumes nearly the entire max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16() with PATH_MAX, causing out-of-bounds write beyond the response buffer. In get_file_all_info(), there was a missing validation check for the client-provided OutputBufferLength before copying the filename into FileName field of the smb2_file_all_info structure. If the filename length exceeds the available buffer space, it could lead to potential buffer overflows or memory corruption during smbConvertToUTF16 conversion. This calculating the actual free buffer size using smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is insufficient and updating smbConvertToUTF16 to use the actual filename length (clamped by PATH_MAX) to ensure a safe copy operation.
Source: NIST NVD / MITRE CVE Database
An attacker could exploit this vulnerability by sending a specially crafted compound request to a ksmbd server, potentially leading to arbitrary code execution or a system crash.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Beyond | — | — |
| Client | — | — |
| Compound | — | — |
| Kernel | — | — |
| Linux | Linux | 6.6 ≥ 5.15.145, < 5.15.203 ≥ 6.1.71, < 6.1.168 |
| Linux | Linux Kernel | 7.0 ≥ 5.15.145, < 5.15.203 ≥ 6.1.71, < 6.1.168 ≥ 6.6, < 6.6.131 ≥ 6.7, < 6.12.80 ≥ 6.13, < 6.18.21+1 more≥ 6.19, < 6.19.11 |
| Safe | — | — |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 52a5e7b89369b32da42eb959ac8154d8d1f5bb31bf108f660c1d06cb076ec66958d268414f96ec3d890f5cd0eff359f48f33242bda6aab20ceb6ca832dc308bd |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →