CVE-2026-31477 (GCVE-0-2026-31477)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-08-05 12:22
VLAI
Title
ksmbd: fix memory leaks and NULL deref in smb2_lock()
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leaks and NULL deref in smb2_lock() smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl: 1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK path, goto out leaks smb_lock and its flock because the out: handler only iterates lock_list and rollback_list, neither of which contains the detached smb_lock. 2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out leaks smb_lock and flock for the same reason. The error code returned to the dispatcher is also stale. 3) In the rollback path, smb_flock_init() can return NULL on allocation failure. The result is dereferenced unconditionally, causing a kernel NULL pointer dereference. Add a NULL check to prevent the crash and clean up the bookkeeping; the VFS lock itself cannot be rolled back without the allocation and will be released at file or connection teardown. Fix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before the if(!rc) check in the UNLOCK branch so all exit paths share one free site, and by freeing smb_lock and flock before goto out in the non-UNLOCK branch. Propagate the correct error code in both cases. Fix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding a NULL check for locks_free_lock(rlock) in the shared cleanup. Found via call-graph analysis using sqry.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < cdac6f7e7e428dc70e3b5898ac6999a72ed13993 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 91aeaa7256006d79a37298f5a1df23325db91599 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 3cdacd11b41569ce75b3162142240f2355e04900 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < aab42f0795620cf0d3955a520f571f697d0f9a2a (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 309b44ed684496ed3f9c5715d10b899338623512 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.6.131 , ≤ 6.6.* (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cdac6f7e7e428dc70e3b5898ac6999a72ed13993",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "91aeaa7256006d79a37298f5a1df23325db91599",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "3cdacd11b41569ce75b3162142240f2355e04900",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "aab42f0795620cf0d3955a520f571f697d0f9a2a",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "309b44ed684496ed3f9c5715d10b899338623512",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix memory leaks and NULL deref in smb2_lock()\n\nsmb2_lock() has three error handling issues after list_del() detaches\nsmb_lock from lock_list at no_check_cl:\n\n1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK\n   path, goto out leaks smb_lock and its flock because the out:\n   handler only iterates lock_list and rollback_list, neither of\n   which contains the detached smb_lock.\n\n2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out\n   leaks smb_lock and flock for the same reason.  The error code\n   returned to the dispatcher is also stale.\n\n3) In the rollback path, smb_flock_init() can return NULL on\n   allocation failure.  The result is dereferenced unconditionally,\n   causing a kernel NULL pointer dereference.  Add a NULL check to\n   prevent the crash and clean up the bookkeeping; the VFS lock\n   itself cannot be rolled back without the allocation and will be\n   released at file or connection teardown.\n\nFix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before\nthe if(!rc) check in the UNLOCK branch so all exit paths share one\nfree site, and by freeing smb_lock and flock before goto out in the\nnon-UNLOCK branch.  Propagate the correct error code in both cases.\nFix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding\na NULL check for locks_free_lock(rlock) in the shared cleanup.\n\nFound via call-graph analysis using sqry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server reachable over the network, normally via SMB over TCP port 445. The vulnerable `SMB2_LOCK` handler processes attacker-supplied SMB2 requests from a remote client.\nAC:L - The attacker controls the SMB2 LOCK request sequence and can repeatedly issue crafted lock/unlock operations after reaching a share and file handle. No race or condition outside attacker influence is required for the leak paths, and the crash path is reachable through normal rollback error handling under allocation pressure.\nPR:N - Although `SMB2_LOCK` is post-session and requires a tree connection and file handle, ksmbd supports guest/anonymous sessions. In a reasonable guest-accessible SMB share deployment, a remote attacker needs no prior credentials to negotiate, connect, open a file, and issue LOCK requests.\nUI:N - No victim user action is required. The server processes the network requests directly.\nS:U - The vulnerability affects the kernel SMB server and impacts the same kernel/server security authority. It does not cross a virtualization, sandbox, or separate authorization boundary.\nC:N - The fixed issues are internal memory leaks and a NULL pointer dereference. They do not provide an information disclosure or arbitrary/kernel memory read primitive.\nI:N - The bug does not provide attacker-controlled writes, memory corruption, or control-flow hijacking. Any stale lock bookkeeping affects availability rather than integrity of data or security state.\nA:H - The rollback path can dereference a NULL `file_lock` allocation result, causing a kernel oops/panic. The leak paths can also be triggered repeatedly to exhaust kernel memory/resources."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:56.049Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cdac6f7e7e428dc70e3b5898ac6999a72ed13993"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9"
        },
        {
          "url": "https://git.kernel.org/stable/c/91aeaa7256006d79a37298f5a1df23325db91599"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cdacd11b41569ce75b3162142240f2355e04900"
        },
        {
          "url": "https://git.kernel.org/stable/c/aab42f0795620cf0d3955a520f571f697d0f9a2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/309b44ed684496ed3f9c5715d10b899338623512"
        }
      ],
      "title": "ksmbd: fix memory leaks and NULL deref in smb2_lock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31477",
    "datePublished": "2026-04-22T13:54:05.470Z",
    "dateReserved": "2026-03-09T15:48:24.098Z",
    "dateUpdated": "2026-08-05T12:22:56.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31477",
      "date": "2026-08-05",
      "epss": "0.00479",
      "percentile": "0.38796"
    },
    "microsoft_vex": {
      "current_release_date": "2026-04-30T14:38:48.000Z",
      "cve": "CVE-2026-31477",
      "id": "msrc_CVE-2026-31477",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: fix memory leaks and NULL deref in smb2_lock()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31477.json",
      "version": "6"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31477\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-22T14:16:44.440\",\"lastModified\":\"2026-06-17T10:33:49.013\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix memory leaks and NULL deref in smb2_lock()\\n\\nsmb2_lock() has three error handling issues after list_del() detaches\\nsmb_lock from lock_list at no_check_cl:\\n\\n1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK\\n   path, goto out leaks smb_lock and its flock because the out:\\n   handler only iterates lock_list and rollback_list, neither of\\n   which contains the detached smb_lock.\\n\\n2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out\\n   leaks smb_lock and flock for the same reason.  The error code\\n   returned to the dispatcher is also stale.\\n\\n3) In the rollback path, smb_flock_init() can return NULL on\\n   allocation failure.  The result is dereferenced unconditionally,\\n   causing a kernel NULL pointer dereference.  Add a NULL check to\\n   prevent the crash and clean up the bookkeeping; the VFS lock\\n   itself cannot be rolled back without the allocation and will be\\n   released at file or connection teardown.\\n\\nFix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before\\nthe if(!rc) check in the UNLOCK branch so all exit paths share one\\nfree site, and by freeing smb_lock and flock before goto out in the\\nnon-UNLOCK branch.  Propagate the correct error code in both cases.\\nFix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding\\na NULL check for locks_free_lock(rlock) in the shared cleanup.\\n\\nFound via call-graph analysis using sqry.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"cdac6f7e7e428dc70e3b5898ac6999a72ed13993\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"91aeaa7256006d79a37298f5a1df23325db91599\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"3cdacd11b41569ce75b3162142240f2355e04900\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"aab42f0795620cf0d3955a520f571f697d0f9a2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"309b44ed684496ed3f9c5715d10b899338623512\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.168\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.131\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.80\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.21\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.11\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.1\",\"versionEndExcluding\":\"6.1.168\",\"matchCriteriaId\":\"9CCD781C-B6A2-442F-817F-8C51A38AFB71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.131\",\"matchCriteriaId\":\"CE6ED4D4-0046-4573-BFA9-D64143B6A89F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.80\",\"matchCriteriaId\":\"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.21\",\"matchCriteriaId\":\"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.11\",\"matchCriteriaId\":\"4CA2E747-A9EC-4518-9AA2-B4247FC748B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"40D9C0D1-0F32-4A2B-9840-1072F5497540\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/309b44ed684496ed3f9c5715d10b899338623512\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cdacd11b41569ce75b3162142240f2355e04900\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/91aeaa7256006d79a37298f5a1df23325db91599\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aab42f0795620cf0d3955a520f571f697d0f9a2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cdac6f7e7e428dc70e3b5898ac6999a72ed13993\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:30:39+00:00",
      "cve": "CVE-2026-31477",
      "id": "CVE-2026-31477",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix memory leaks and NULL deref in smb2_lock()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31477.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.