Loading story…
Red Hat and the Linux kernel CVE team disclosed CVE-2026-31709, an Important-severity flaw in the Linux kernel SMB client’s cifsacl code that can be triggered by a malicious SMB server. The bug stems from insufficient validation of a server-supplied DACL during chmod and chown security descriptor handling, allowing a truncated DACL with a valid header and overstated ACE count to drive out-of-bounds reads or copies in fs/smb/client/cifsacl.c. Red Hat assigned the issue a CVSS v3 score of 7.8 and said successful exploitation could cause memory corruption, information disclosure, or denial of service.
The vulnerable code was introduced in kernel 5.12, and the fix adds a shared validate_dacl() routine with full DACL and per-ACE bounds checks, which is also reused by parse_dacl() for consistent validation. Red Hat said corrected kernel packages have been released across multiple product streams including RHEL 8, RHEL 9, and RHEL 10, while RHEL 6 is not affected because the vulnerable code is absent; the issue is also included in RHSA-2026:23329 for RHEL 10. Red Hat advised customers to apply the updated kernel packages and reboot affected systems, and said organizations that do not need SMB client functionality can mitigate exposure by blacklisting the cifs kernel module.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-04, Red Hat published RHSA-2026:23329, an Important kernel security advisory for RHEL 10 that included a fix for CVE-2026-31709. The advisory bundled seven kernel CVE fixes and instructed customers to reboot after applying the update.
On 2026-05-28, Red Hat released fixes for CVE-2026-31709 in RHEL 9 via RHSA-2026:21556 and in RHEL 8 via RHSA-2026:21706 and RHSA-2026:21745. These updates addressed the kernel SMB client cifsacl flaw across standard and kernel-rt package streams.
On 2026-05-01, the Linux kernel CVE team announced CVE-2026-31709 for insufficient validation of a server-supplied DACL in SMB client cifsacl. The advisory described how a malicious SMB server could trigger out-of-bounds reads or copies during chmod/chown security descriptor handling.
Red Hat's CVE page says its advisory for CVE-2026-31709 was last modified on 2026-06-30. The advisory documents the flaw as Important severity, provides mitigation guidance to blacklist the cifs module if unused, and lists affected and fixed product streams.
On 2026-06-08, Red Hat released RHSA-2026:24343 to address CVE-2026-31709 in Red Hat Enterprise Linux 10.0 Extended Update Support. This extended the fix to the RHEL 10 EUS stream.
On 2026-06-04, Red Hat also released fixes for CVE-2026-31709 in RHEL 9.4 Update Services for SAP Solutions via RHSA-2026:23237 and in RHEL 9.6 Extended Update Support via RHSA-2026:23224. These expanded patched coverage to additional supported RHEL 9 streams.
On 2026-06-03, Red Hat published fixes for CVE-2026-31709 for RHEL 9.2 Update Services for SAP Solutions through RHSA-2026:22900 and RHSA-2026:22940. The advisories covered both kernel and kernel-rt package variants.
The same vulnerability was also fixed in Linux kernel 7.1-rc1. The kernel CVE announcement identifies commit 0a8cf165566ba55a39fd0f4de172119dd646d39a as the corresponding fix.
The Linux kernel CVE announcement says CVE-2026-31709 was fixed in Linux kernel 7.0.2 by adding shared structural DACL validation with per-ACE bounds checks. It cites fixing commit b78db9bddc84136f6a0bb49e8883cf200dfb87a8.
The Linux kernel CVE announcement states the flawed SMB client cifsacl code path was introduced in Linux kernel 5.12. It attributes the introduction to commit bc3e9dd9d104ca1b75644eab87b38ce8a924aef4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed two **Important** Linux kernel vulnerabilities in the SMB client’s `cifsacl` handling that can be triggered by a malicious SMB server and lead to memory corruption. **`CVE-2026-31709`** affects DACL parsing when a server advertises more ACEs than are actually present, causing insufficient validation and resulting in out-of-bounds memory read or copy behavior. Red Hat said the flaw can cause information disclosure or denial of service and assigned it a CVSS v3 score of **7.8**. A second flaw, **`CVE-2026-46195`**, affects **32-bit** Red Hat Enterprise Linux systems and stems from a crafted `dacloffset` value that can trigger pointer wrap during `chmod` or `chown` operations, leading to invalid DACL dereferences and memory corruption. Red Hat warned the issue could cause denial of service or bypass security mechanisms, scored it **7.5**, and mapped it to **`CWE-787`**, a class of out-of-bounds write weaknesses that can corrupt memory and potentially alter program control flow. Red Hat published fixes across multiple RHEL 8 and 9 kernel streams, noted some product variants remained affected at disclosure, and advised organizations that do not need SMB client functionality to blacklist the `cifs` kernel module as a mitigation.
Aug 25, 2026
A flaw tracked as **CVE-2026-43158** in the Linux kernel's **XFS** filesystem can let a local user trigger a denial of service by causing an assertion failure and filesystem shutdown. The bug affects XFS attribute leaf block handling during repeated `setxattr` operations: crafted extended attribute insertions can corrupt freemap accounting so that the entries array overlaps free space. The issue is classified as **CWE-617 Reachable Assertion**, carries a **CVSS v3 score of 7.0** from Red Hat, and traces back to code introduced in Linux `2.6.12`. The Linux kernel community published fixes across multiple stable branches, with maintainers advising organizations to update to current stable kernels rather than cherry-pick patches. Red Hat said no acceptable mitigation is available and shipped fixes through updated **RHEL** kernel packages and errata, including advisory **RHSA-2026:27735** for **RHEL 9.4 Update Services for SAP Solutions** and related variants. That advisory bundles **CVE-2026-43158** with other kernel vulnerabilities in components including **libceph**, **netfilter**, **SMB/CIFS**, **SCTP**, and **mac80211**, and requires affected systems to be rebooted after installation.
Aug 25, 2026
Red Hat released kernel security updates for **RHEL 8**, RHEL 8 Real Time, and **RHEL 9** that address Linux-kernel vulnerabilities ranging from memory-safety defects and denial of service to local privilege escalation and potential remote code execution. Notable issues include the CIFS-client RCE flaw, a GSM multiplexing privilege-escalation race, and use-after-free defects in `nf_tables`/nftables and AMDGPU. `CVE-2023-4244` arises from a race between nftables set garbage collection and transactions, allowing a local attacker to crash a host and potentially disclose kernel information. The updates also remediate `CVE-2023-52434`, in which insufficient validation of SMB2 create-context offsets and lengths in `smb2_parse_contexts()` lets a malicious or malformed SMB server trigger an out-of-bounds access and kernel page fault on an SMB/CIFS client. Red Hat shipped affected fixes through advisories including RHSA-2024:1248, RHSA-2024:1607/1614, RHSA-2024:2950, and RHSA-2024:3138, covering supported x86_64, s390x, ppc64le, and aarch64 streams as applicable; organizations should install the relevant kernel packages, reboot hosts, and rebuild dependent `rhel9/support-tools` and `el9/flatpak-sdk` container images.
Aug 26, 2026