CyberSecBulletin
CVE-2026-31433NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-31433 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions 3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7, 4cca3eff2099b18672934a39cee70aed835d652c, 358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.6% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7 or 4cca3eff2099b18672934a39cee70aed835d652c or 358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe or 7aec5a769d2356cbf344d85bcfd36de592ac96a5, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.203 or 6.1.168 or 6.6.131 or 6.12.80, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxf2283680a80571ca82d710bc6ecd8f8beac67d63 up to, but not including, 3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7; 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 up to, but not including, 4cca3eff2099b18672934a39cee70aed835d652c; e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d up to, but not including, 358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe; e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d up to, but not including, 7aec5a769d2356cbf344d85bcfd36de592ac96a5; e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d up to, but not including, b0cd9725fe2bcc9f37d096b132318a9060373f5d; e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d up to, but not including, 9d7032851d6f5adbe2739601ca456c0ad3b422f0; e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d up to, but not including, beef2634f81f1c086208191f7228bce1d366493d; 5.15.145 up to, but not including, 5.15.203; and 2 more ranges3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7, 4cca3eff2099b18672934a39cee70aed835d652c, 358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe, 7aec5a769d2356cbf344d85bcfd36de592ac96a5, b0cd9725fe2bcc9f37d096b132318a9060373f5d, 9d7032851d6f5adbe2739601ca456c0ad3b422f0
LinuxLinux Kernel5.15.145 up to, but not including, 5.15.203; 6.1.71 up to, but not including, 6.1.168; 6.6 up to, but not including, 6.6.131; 6.7 up to, but not including, 6.12.80; 6.13 up to, but not including, 6.18.21; 6.19 up to, but not including, 6.19.11; 7.05.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound request consists of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) and the first command consumes nearly the entire max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16() with PATH_MAX, causing out-of-bounds write beyond the response buffer. In get_file_all_info(), there was a missing validation check for the client-provided OutputBufferLength before copying the filename into FileName field of the smb2_file_all_info structure. If the filename length exceeds the available buffer space, it could lead to potential buffer overflows or memory corruption during smbConvertToUTF16 conversion. This calculating the actual free buffer size using smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is insufficient and updating smbConvertToUTF16 to use the actual filename length (clamped by PATH_MAX) to ensure a safe copy operation.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.