Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s in-kernel SMB server, ksmbd, can miscalculate response-buffer limits because some code uses a fixed header length instead of the response structure’s actual buffer offset. The supplied CVSS rates potential confidentiality, integrity, and availability impact as high.
Executive priority
Treat exposed ksmbd servers as an urgent patching priority because the supplied rating is critical and requires no privileges or user interaction. Do not interpret that rating as proof of exploitation. Confirm service use and vendor package status immediately; schedule other affected internal systems through accelerated remediation.
Technical view
Following dynamic response-iovec changes for compound reads, smb2_calc_max_out_buf_len() expects hdr2_len to represent the response structure’s Buffer-field offset. Remaining callers supplied hardcoded values. Stable-kernel patches replace those values with offsetof(). The supplied sources do not describe the resulting memory fault, trigger conditions, or exploit primitive.
Likely exposure
Exposure is limited to systems running affected Linux kernels where ksmbd is enabled. Network-reachable SMB services deserve first attention because the supplied CVSS describes unauthenticated, low-complexity network attackability. The affected-version data includes multiple maintained kernel lines, but package applicability must be confirmed with the system’s distribution vendor.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation or a public proof of concept. CVSS 9.8 indicates severe theoretical remote impact, but the sources do not document a demonstrated attack path. Treat internet- or untrusted-network-accessible ksmbd servers as urgent pending vendor confirmation.
Researcher notes
The record identifies an API-contract mismatch in response-length calculation rather than a fully characterized vulnerability mechanism. No CWE, malformed-request details, crash evidence, memory-corruption classification, proof of concept, or exploitation telemetry is supplied. Researchers should avoid inferring code execution solely from the CVSS impacts.
Mitigation direction
- Inventory systems where ksmbd is enabled and identify their exact kernel packages.
- Prioritize ksmbd services reachable from internet or untrusted networks.
- Apply a vendor-supported kernel update incorporating the relevant stable fix.
- If no update is available, obtain supported mitigation guidance from the distribution vendor.
Validation and detection
- Confirm whether ksmbd is enabled on each potentially affected host.
- Compare installed kernel packages with vendor-provided affected and fixed versions.
- Verify the relevant stable fix appears in package changelogs or kernel source.
- After updating, confirm the intended kernel is running and SMB service functionality remains healthy.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31478 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/70b4c414889492c522b6e4331562360f49be2361CVE reference, Linux
- https://git.kernel.org/stable/c/9a7166f0ef8cbb7bb48dd05e2471d995566003f5CVE reference, Linux
- https://git.kernel.org/stable/c/c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683CVE reference, Linux
- https://git.kernel.org/stable/c/6aef1765d6807e0f027cd87f6ac973eb0879a46dCVE reference, Linux
- https://git.kernel.org/stable/c/80824c7e527b70cf9039534e60aff592e8f209d1CVE reference, Linux
- https://git.kernel.org/stable/c/4cb537ae4f37d7d0f617815ed4bed7173fb50861CVE reference, Linux
- https://git.kernel.org/stable/c/0e55f63dd08f09651d39e1b709a91705a8a0ddcbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.