Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-04-24T00:00:00 kernel: smb: client: fix off-by-8 bounds check in check_wsl_eas() 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA name and value, but ea_data sits at offset sizeof(struct smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp() later reads ea->ea_data[0..nlen-1] and the value bytes follow at ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1 + vlen. Isn't pointer math fun? The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the 8-byte header is in bounds, but since the last EA is placed within 8 bytes of the end of the response, the name and value bytes are read past the end of iov. Fix this mess all up by using ea->ea_data as the base for the bounds check. An "untrusted" server can use this to leak up to 8 bytes of kernel heap into the EA name comparison and influence which WSL xattr the data is interpreted as.

A flaw was found in the Linux kernel's Server Message Block (SMB) client. An untrusted server can exploit an out-of-bounds read vulnerability within the `check_wsl_eas()` function. This flaw allows the server to read up to 8 bytes beyond the intended memory boundary, leading to information disclosure. The leaked kernel memory could potentially disclose sensitive data and influence the interpretation of Windows Subsystem for Linux (WSL) extended attributes.

An off-by-eight bounds check when parsing WSL-style EAs could let a malicious server read adjacent client memory. Red Hat advises treating this as SMB client parser hardening; install updates. `cifs` unload remains the coarse mitigation. To mitigate this issue, prevent the cifs module from being loaded. See https://access.redhat.com/solutions/41278 for instructions. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-31614 https://nvd.nist.gov/vuln/detail/CVE-2026-31614 https://lore.kernel.org/linux-cve-announce/2026042423-CVE-2026-31614-4bf1@gregkh/T