Loading story…
Red Hat disclosed two Important Linux kernel vulnerabilities in the SMB client’s cifsacl handling that can be triggered by a malicious SMB server and lead to memory corruption. CVE-2026-31709 affects DACL parsing when a server advertises more ACEs than are actually present, causing insufficient validation and resulting in out-of-bounds memory read or copy behavior. Red Hat said the flaw can cause information disclosure or denial of service and assigned it a CVSS v3 score of 7.8.
A second flaw, CVE-2026-46195, affects 32-bit Red Hat Enterprise Linux systems and stems from a crafted dacloffset value that can trigger pointer wrap during chmod or chown operations, leading to invalid DACL dereferences and memory corruption. Red Hat warned the issue could cause denial of service or bypass security mechanisms, scored it 7.5, and mapped it to CWE-787, a class of out-of-bounds write weaknesses that can corrupt memory and potentially alter program control flow. Red Hat published fixes across multiple RHEL 8 and 9 kernel streams, noted some product variants remained affected at disclosure, and advised organizations that do not need SMB client functionality to blacklist the cifs kernel module as a mitigation.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released further CVE-2026-31709 fixes for RHEL 10 kernel, RHEL 9.4 Update Services for SAP Solutions kernel, and RHEL 9.6 Extended Update Support kernel in advisories RHSA-2026:23329, RHSA-2026:23237, and RHSA-2026:23224. These advisories expanded fixed coverage across additional enterprise product streams.
Additional fixes for CVE-2026-31709 were released for RHEL 9.2 Update Services for SAP Solutions kernel and kernel-rt packages in advisories RHSA-2026:22940 and RHSA-2026:22900. These updates extended remediation coverage to SAP-focused RHEL 9.2 streams.
Red Hat listed fixed packages for CVE-2026-31709 in RHEL 8 kernel-rt, RHEL 8 kernel, and RHEL 9 kernel through advisories RHSA-2026:21745, RHSA-2026:21706, and RHSA-2026:21556. These updates addressed the SMB client cifsacl validation flaw in affected product streams.
On the same day as disclosure, Red Hat listed fixes for CVE-2026-46195 in RHEL 8 kernel-rt, RHEL 8 kernel, and RHEL 9 kernel advisories RHSA-2026:21745, RHSA-2026:21706, and RHSA-2026:21556. RHEL 10 kernel and RHEL 9 kernel-rt remained affected at the time of the notice.
Red Hat disclosed CVE-2026-46195, an Important-severity Linux kernel SMB client vulnerability affecting 32-bit Red Hat Enterprise Linux systems, where a crafted dacloffset from a malicious SMB server can trigger pointer wrap and memory corruption during chmod or chown operations. The notice included mitigation guidance to avoid mounts from untrusted SMB servers and mapped the issue to CWE-787.
Red Hat published an advisory for CVE-2026-31709, an Important-severity Linux kernel SMB client cifsacl flaw in which a malformed DACL can advertise more ACEs than are present, causing out-of-bounds memory read or copy behavior and possible memory corruption. Red Hat classified the issue as CWE-1288 and recommended blacklisting the cifs kernel module if SMB client functionality is not needed.
Red Hat published RHSA-2026:24343 to fix CVE-2026-31709 in RHEL 10.0 Extended Update Support kernel packages. This completed another product-stream-specific remediation step for the SMB client flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat and the Linux kernel CVE team disclosed **CVE-2026-31709**, an Important-severity flaw in the Linux kernel SMB client’s `cifsacl` code that can be triggered by a malicious SMB server. The bug stems from insufficient validation of a server-supplied DACL during `chmod` and `chown` security descriptor handling, allowing a truncated DACL with a valid header and overstated ACE count to drive out-of-bounds reads or copies in `fs/smb/client/cifsacl.c`. Red Hat assigned the issue a CVSS v3 score of **7.8** and said successful exploitation could cause memory corruption, information disclosure, or denial of service. The vulnerable code was introduced in kernel **5.12**, and the fix adds a shared `validate_dacl()` routine with full DACL and per-ACE bounds checks, which is also reused by `parse_dacl()` for consistent validation. Red Hat said corrected kernel packages have been released across multiple product streams including **RHEL 8, RHEL 9, and RHEL 10**, while **RHEL 6** is not affected because the vulnerable code is absent; the issue is also included in **RHSA-2026:23329** for RHEL 10. Red Hat advised customers to apply the updated kernel packages and reboot affected systems, and said organizations that do not need SMB client functionality can mitigate exposure by blacklisting the `cifs` kernel module.
Aug 25, 2026
Red Hat released kernel security updates for **RHEL 8**, RHEL 8 Real Time, and **RHEL 9** that address Linux-kernel vulnerabilities ranging from memory-safety defects and denial of service to local privilege escalation and potential remote code execution. Notable issues include the CIFS-client RCE flaw, a GSM multiplexing privilege-escalation race, and use-after-free defects in `nf_tables`/nftables and AMDGPU. `CVE-2023-4244` arises from a race between nftables set garbage collection and transactions, allowing a local attacker to crash a host and potentially disclose kernel information. The updates also remediate `CVE-2023-52434`, in which insufficient validation of SMB2 create-context offsets and lengths in `smb2_parse_contexts()` lets a malicious or malformed SMB server trigger an out-of-bounds access and kernel page fault on an SMB/CIFS client. Red Hat shipped affected fixes through advisories including RHSA-2024:1248, RHSA-2024:1607/1614, RHSA-2024:2950, and RHSA-2024:3138, covering supported x86_64, s390x, ppc64le, and aarch64 streams as applicable; organizations should install the relevant kernel packages, reboot hosts, and rebuild dependent `rhel9/support-tools` and `el9/flatpak-sdk` container images.
Aug 26, 2026
Red Hat released **Important** live kernel patch advisories for Red Hat Enterprise Linux 8, 9, and 10 to remediate two Linux kernel vulnerabilities: `CVE-2026-46243` in the SMB/CIFS client and `CVE-2026-46331` in `net/sched/act_pedit`. The updates were published across multiple `kpatch` streams, including RHEL 8.8 and 8.10, RHEL 9.2, 9.4, 9.6, and 9.8 variants, and RHEL 10, covering x86_64 and ppc64le platforms as well as AUS, SAP Solutions, Extended Update Support, and Extended Life Cycle channels. `CVE-2026-46243` stems from the kernel SMB client accepting userspace-created `cifs.spnego` key descriptions whose authority-bearing fields could be trusted by `cifs.upcall` as if they came from the kernel; the fix restricts acceptance to requests made while CIFS is using its private `spnego_cred`. `CVE-2026-46331` affects `tcf_pedit_act()`, where packet edits could shift later header-relative offsets and cause writes beyond the originally ensured writable packet range; the fix expands the writable range using each key’s final computed write offset before mutation. Red Hat delivered the remediations through updated live patch modules so affected systems can be patched without rebooting.
Aug 25, 2026