CVE-2026-31478
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number. Fix the remaining call sites to use the correct offsetof() value.
- Affected products
- Linuxmint, Linux Kernel
- Linux Linux Kernel
- < 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 6.6, 7.0
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 0.5% (40th percentile)
- NVD status
- Analyzed
- Published
- 2026-04-22
No indexed exploits for CVE-2026-31478 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-31478 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.