CVE-2026-31611

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: require 3 sub-authorities before reading sub_auth[2]<br /> <br /> parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on<br /> match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is<br /> the prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares<br /> only min(num_subauth, 2) sub-authorities so a client SID with<br /> num_subauth = 2 and sub_auth = {88, 3} will match.<br /> <br /> If num_subauth = 2 and the ACE is placed at the very end of the security<br /> descriptor, sub_auth[2] will be 4 bytes past end_of_acl. The<br /> out-of-band bytes will then be masked to the low 9 bits and applied as<br /> the file&amp;#39;s POSIX mode, probably not something that is good to have<br /> happen.<br /> <br /> Fix this up by forcing the SID to actually carry a third sub-authority<br /> before reading it at all.