CVE-2026-31612

kernel: ksmbd: validate EaNameLength in smb2_get_ea()

Loading…

Severity

Low

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · April 24, 2026

Updated · October 20, 2026

Description

A flaw was found in ksmbd, a Linux kernel module. A remote attacker can exploit this vulnerability by sending a specially crafted client request to the smb2_get_ea() function. Due to improper validation of the EaNameLength field, the system may leak uninitialized heap memory values, leading to information disclosure.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-130 · Improper Handling of Length Parameter Inconsistency