9.8

CVE-2026-31478: linux Incorrect Calculation of Buffer Size

CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-31478DEBIAN-CVE-2026-31478
Published 22-04-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-31478 is a critical (CVSS 9.8) Incorrect Calculation of Buffer Size vulnerability in linux. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.74%
0%100%
Low · +0.24 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 26
LSN-0121-1LSN-0122-1MGASA-2026-0108MGASA-2026-0110USN-8492-1USN-8492-2

Timeline

  1. 22-04-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.74%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

+0.24 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu145 products
  • linux< 5.15.0-185.195 | < 6.8.0-134.134 | < 6.17.0-40.40
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1111.118 | < 6.8.0-1060.63 | < 6.17.0-1019.19
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ f2283680a80571ca82d710bc6ecd8f8beac67d63, < 70b4c414889492c522b6e4331562360f49be2361 | ≥ 9f297df20d93411c0b4ddad7f88ba04a7cd36e77, < 9a7166f0ef8cbb7bb48dd05e2471d995566003f5 | ≥ e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d, < c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683 | ≥ e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d, < 6aef1765d6807e0f027cd87f6ac973eb0879a46d | ≥ e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d, < 80824c7e527b70cf9039534e60aff592e8f209d1 | ≥ e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d, < 4cb537ae4f37d7d0f617815ed4bed7173fb50861 | ≥ e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d, < 0e55f63dd08f09651d39e1b709a91705a8a0ddcb | ≥ 5.15.145, < 5.15.203 | ≥ 6.1.71, < 6.1.168 | 6.6
  • linux_kernel≥ 5.15.145, < 5.15.203 | ≥ 6.1.71, < 6.1.168 | ≥ 6.6.1, < 6.6.131 | ≥ 6.7, < 6.12.80 | ≥ 6.13, < 6.18.21 | ≥ 6.19, < 6.19.11 | 6.6 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6 | 7.0:rc7
Debian1 product
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.11-1

3 vendors · 148 products

References

37 links
Show all 37 references