SB20260502143 - Integer overflow in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Integer overflow (CVE-ID: CVE-2026-31707)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in ipc_validate_msg() when validating daemon response messages. A local user can supply a specially crafted daemon response with a wrapped size value to cause a denial of service.

The issue affects multiple response types, including RPC request, share config request, and extended login request handling, and negative ngroups values can influence size computation.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b
• https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1
• https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4
• https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b