CVE-2026-31478 | In the Linux kernel, the following vulnerability has been re… | CVSS 9.8 CRITICAL

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value.

Metadata

CVE ID: CVE-2026-31478
State: PUBLISHED
Assigner: Linux
Reserved: 2026-03-09 15:48 UTC
Published: 2026-04-22 13:54 UTC
Last updated: 2026-05-23 16:05 UTC
Vendor / Product: Linux / Linux
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products (2)

Vendor	Product	Platform	Versions
Linux	Linux	—	f2283680a80571ca82d710bc6ecd8f8beac67d63 < 70b4c414889492c522b6e4331562360f49be2361, 9f297df20d93411c0b4ddad7f88ba04a7cd36e77 < 9a7166f0ef8cbb7bb48dd05e2471d995566003f5, e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683, e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 6aef1765d6807e0f027cd87f6ac973eb0879a46d …
Linux	Linux	—	6.6, 0 < 6.6, 5.15.203 ≤ 5.15., 6.1.168 ≤ 6.1. …

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (7)