CyberSecBulletin
CVE-2026-31613NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-31613 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists versions 043834e72337ee7b4e9685859888623ba1504ac7, d65a64755a3df68a2fd19d2a81395e9f723aca23, 20ac98f0eb6047edb73c9a27af782bdde08b3757 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.39% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 043834e72337ee7b4e9685859888623ba1504ac7 or d65a64755a3df68a2fd19d2a81395e9f723aca23 or 20ac98f0eb6047edb73c9a27af782bdde08b3757 or e0dd90d14cbbf318157ea8e3fb62ee68a28655ed, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.18.24 or 6.19.14 or 7.0.1, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
  4. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux76894f3e2f71177747b8b4763fb180e800279585 up to, but not including, 043834e72337ee7b4e9685859888623ba1504ac7; 76894f3e2f71177747b8b4763fb180e800279585 up to, but not including, d65a64755a3df68a2fd19d2a81395e9f723aca23; 76894f3e2f71177747b8b4763fb180e800279585 up to, but not including, 20ac98f0eb6047edb73c9a27af782bdde08b3757; 76894f3e2f71177747b8b4763fb180e800279585 up to, but not including, e0dd90d14cbbf318157ea8e3fb62ee68a28655ed; 76894f3e2f71177747b8b4763fb180e800279585 up to, but not including, 781902e069f4ecb6c3b83502f181972c1446110a; 76894f3e2f71177747b8b4763fb180e800279585 up to, but not including, a66ef2e7ed837325c5600f8617d5ee0a0a149fdd; 76894f3e2f71177747b8b4763fb180e800279585 up to, but not including, 3df690bba28edec865cf7190be10708ad0ddd67e; 2d046892a493d9760c35fdaefc3017f27f91b621; and 2 more ranges043834e72337ee7b4e9685859888623ba1504ac7, d65a64755a3df68a2fd19d2a81395e9f723aca23, 20ac98f0eb6047edb73c9a27af782bdde08b3757, e0dd90d14cbbf318157ea8e3fb62ee68a28655ed, 781902e069f4ecb6c3b83502f181972c1446110a, a66ef2e7ed837325c5600f8617d5ee0a0a149fdd
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel6.1 up to, but not including, 6.18.24; 6.19 up to, but not including, 6.19.14; 7.0 up to, but not including, 7.0.16.18.24, 6.19.14, 7.0.1

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server. symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset 0. When the server-controlled ErrorDataLength advances p to within 1-7 bytes of end, the next iteration will read past it. When the matching context is found, sym->SymLinkErrorTag is read at offset 4 from p->ErrorContextData with no check that the symlink header itself fits. smb2_parse_symlink_response() then bounds-checks the substitute name using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from iov_base. That value is computed as sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), which is correct only when ErrorContextCount == 0. With at least one error context the symlink data sits 8 bytes deeper, and each skipped non-matching context shifts it further by 8 + ALIGN(ErrorDataLength, 8). The check is too short, allowing the substitute name read to run past iov_len. The out-of-bound heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2). Fix this all up by making the loops test require the full context header to fit, rejecting sym if its header runs past end, and bound the substitute name against the actual position of sym->PathBuffer rather than a fixed offset. Because sub_offs and sub_len are 16bits, the pointer math will not overflow here with the new greater-than.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.