CVE-2026-31707 (GCVE-0-2026-31707)

Vulnerability from cvelistv5 – Published: 2026-05-01 13:56 – Updated: 2026-08-05 12:24
VLAI
Title
ksmbd: validate response sizes in ipc_validate_msg()
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate response sizes in ipc_validate_msg() ipc_validate_msg() computes the expected message size for each response type by adding (or multiplying) attacker-controlled fields from the daemon response to a fixed struct size in unsigned int arithmetic. Three cases can overflow: KSMBD_EVENT_RPC_REQUEST: msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; KSMBD_EVENT_SHARE_CONFIG_REQUEST: msg_sz = sizeof(struct ksmbd_share_config_response) + resp->payload_sz; KSMBD_EVENT_LOGIN_REQUEST_EXT: msg_sz = sizeof(struct ksmbd_login_response_ext) + resp->ngroups * sizeof(gid_t); resp->payload_sz is __u32 and resp->ngroups is __s32. Each addition can wrap in unsigned int; the multiplication by sizeof(gid_t) mixes signed and size_t, so a negative ngroups is converted to SIZE_MAX before the multiply. A wrapped value of msg_sz that happens to equal entry->msg_sz bypasses the size check on the next line, and downstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz, kmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the unverified length. Use check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST paths to detect integer overflow without constraining functional payload size; userspace ksmbd-tools grows NDR responses in 4096-byte chunks for calls like NetShareEnumAll, so a hard transport cap is unworkable on the response side. For LOGIN_REQUEST_EXT, reject resp->ngroups outside the signed [0, NGROUPS_MAX] range up front and report the error from ipc_validate_msg() so it fires at the IPC boundary; with that bound the subsequent multiplication and addition stay well below UINT_MAX. The now-redundant ngroups check and pr_err in ksmbd_alloc_user() are removed. This is the response-side analogue of aab98e2dbd64 ("ksmbd: fix integer overflows on 32 bit systems"), which hardened the request side.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < bf396208418371174869baba9434535cd3288e80 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 7dd0c858e1909769a4c91842724315ee74f1a5f1 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 299db777ea0cfa5c407e41b045c24a14c034c27b (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 99c631d0366c1eab8fb188fe66425f4581ebdde4 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < d6a6aa81eac2c9bff66dc6e191179cb69a14426b (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.84 , ≤ 6.12.* (semver)
Unaffected: 6.18.25 , ≤ 6.18.* (semver)
Unaffected: 7.0.2 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_config.c",
            "fs/smb/server/transport_ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf396208418371174869baba9434535cd3288e80",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "7dd0c858e1909769a4c91842724315ee74f1a5f1",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "299db777ea0cfa5c407e41b045c24a14c034c27b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "99c631d0366c1eab8fb188fe66425f4581ebdde4",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "d6a6aa81eac2c9bff66dc6e191179cb69a14426b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_config.c",
            "fs/smb/server/transport_ipc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.84",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.25",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate response sizes in ipc_validate_msg()\n\nipc_validate_msg() computes the expected message size for each\nresponse type by adding (or multiplying) attacker-controlled fields\nfrom the daemon response to a fixed struct size in unsigned int\narithmetic.  Three cases can overflow:\n\n  KSMBD_EVENT_RPC_REQUEST:\n      msg_sz = sizeof(struct ksmbd_rpc_command) + resp-\u003epayload_sz;\n  KSMBD_EVENT_SHARE_CONFIG_REQUEST:\n      msg_sz = sizeof(struct ksmbd_share_config_response) +\n               resp-\u003epayload_sz;\n  KSMBD_EVENT_LOGIN_REQUEST_EXT:\n      msg_sz = sizeof(struct ksmbd_login_response_ext) +\n               resp-\u003engroups * sizeof(gid_t);\n\nresp-\u003epayload_sz is __u32 and resp-\u003engroups is __s32.  Each addition\ncan wrap in unsigned int; the multiplication by sizeof(gid_t) mixes\nsigned and size_t, so a negative ngroups is converted to SIZE_MAX\nbefore the multiply.  A wrapped value of msg_sz that happens to\nequal entry-\u003emsg_sz bypasses the size check on the next line, and\ndownstream consumers (smb2pdu.c:6742 memcpy using rpc_resp-\u003epayload_sz,\nkmemdup in ksmbd_alloc_user using resp_ext-\u003engroups) then trust the\nunverified length.\n\nUse check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST\npaths to detect integer overflow without constraining functional\npayload size; userspace ksmbd-tools grows NDR responses in 4096-byte\nchunks for calls like NetShareEnumAll, so a hard transport cap is\nunworkable on the response side.  For LOGIN_REQUEST_EXT, reject\nresp-\u003engroups outside the signed [0, NGROUPS_MAX] range up front and\nreport the error from ipc_validate_msg() so it fires at the IPC\nboundary; with that bound the subsequent multiplication and addition\nstay well below UINT_MAX.  The now-redundant ngroups check and\npr_err in ksmbd_alloc_user() are removed.\n\nThis is the response-side analogue of aab98e2dbd64 (\"ksmbd: fix\ninteger overflows on 32 bit systems\"), which hardened the request\nside."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed length fields enter the kernel through ksmbd generic-netlink IPC response messages, not directly from SMB network packets. SMB traffic can create the pending request, but the attacker must be local to inject or control the IPC response.\nAC:L - The attacker controls the response fields and can choose wrapped sizes that satisfy the old equality check. Any response race is practical because handles are small/predictable and the attacker can trigger repeated pending requests.\nPR:L - The IPC response handlers are gated by CAP_NET_ADMIN when the default check is enabled, but the generic-netlink family is netns-aware and CAP_NET_ADMIN is commonly reachable from an unprivileged user namespace. If that check is disabled, no capability is needed, so Low is the conservative privilege choice.\nUI:N - No victim user action is required once ksmbd is running. The attacker can trigger the SMB-side request and send the crafted IPC response directly.\nS:U - The vulnerability affects kernel memory and ksmbd state within the same host security authority. It does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - The wrapped RPC response size can make downstream code copy data beyond the validated response buffer, including into SMB responses. This can disclose kernel heap memory and is best scored as high confidentiality impact.\nI:N - The investigated consumers primarily perform oversized reads from the undersized IPC response or fail large allocations. I did not find a direct out-of-bounds write or control-flow overwrite primitive from this bug alone.\nA:H - The oversized copies and huge allocations can trigger kernel faults, memory exhaustion, or service failure. Repeated crafted responses can therefore produce high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:42.073Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf396208418371174869baba9434535cd3288e80"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b"
        },
        {
          "url": "https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b"
        }
      ],
      "title": "ksmbd: validate response sizes in ipc_validate_msg()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31707",
    "datePublished": "2026-05-01T13:56:05.219Z",
    "dateReserved": "2026-03-09T15:48:24.132Z",
    "dateUpdated": "2026-08-05T12:24:42.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31707",
      "date": "2026-08-10",
      "epss": "0.00125",
      "percentile": "0.02582"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-22T01:43:04.000Z",
      "cve": "CVE-2026-31707",
      "id": "msrc_CVE-2026-31707",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: validate response sizes in ipc_validate_msg()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31707.json",
      "version": "6"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31707\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T14:16:20.720\",\"lastModified\":\"2026-06-17T10:34:16.900\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: validate response sizes in ipc_validate_msg()\\n\\nipc_validate_msg() computes the expected message size for each\\nresponse type by adding (or multiplying) attacker-controlled fields\\nfrom the daemon response to a fixed struct size in unsigned int\\narithmetic.  Three cases can overflow:\\n\\n  KSMBD_EVENT_RPC_REQUEST:\\n      msg_sz = sizeof(struct ksmbd_rpc_command) + resp-\u003epayload_sz;\\n  KSMBD_EVENT_SHARE_CONFIG_REQUEST:\\n      msg_sz = sizeof(struct ksmbd_share_config_response) +\\n               resp-\u003epayload_sz;\\n  KSMBD_EVENT_LOGIN_REQUEST_EXT:\\n      msg_sz = sizeof(struct ksmbd_login_response_ext) +\\n               resp-\u003engroups * sizeof(gid_t);\\n\\nresp-\u003epayload_sz is __u32 and resp-\u003engroups is __s32.  Each addition\\ncan wrap in unsigned int; the multiplication by sizeof(gid_t) mixes\\nsigned and size_t, so a negative ngroups is converted to SIZE_MAX\\nbefore the multiply.  A wrapped value of msg_sz that happens to\\nequal entry-\u003emsg_sz bypasses the size check on the next line, and\\ndownstream consumers (smb2pdu.c:6742 memcpy using rpc_resp-\u003epayload_sz,\\nkmemdup in ksmbd_alloc_user using resp_ext-\u003engroups) then trust the\\nunverified length.\\n\\nUse check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST\\npaths to detect integer overflow without constraining functional\\npayload size; userspace ksmbd-tools grows NDR responses in 4096-byte\\nchunks for calls like NetShareEnumAll, so a hard transport cap is\\nunworkable on the response side.  For LOGIN_REQUEST_EXT, reject\\nresp-\u003engroups outside the signed [0, NGROUPS_MAX] range up front and\\nreport the error from ipc_validate_msg() so it fires at the IPC\\nboundary; with that bound the subsequent multiplication and addition\\nstay well below UINT_MAX.  The now-redundant ngroups check and\\npr_err in ksmbd_alloc_user() are removed.\\n\\nThis is the response-side analogue of aab98e2dbd64 (\\\"ksmbd: fix\\ninteger overflows on 32 bit systems\\\"), which hardened the request\\nside.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/mgmt/user_config.c\",\"fs/smb/server/transport_ipc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"bf396208418371174869baba9434535cd3288e80\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"7dd0c858e1909769a4c91842724315ee74f1a5f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"299db777ea0cfa5c407e41b045c24a14c034c27b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"99c631d0366c1eab8fb188fe66425f4581ebdde4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0626e6641f6b467447c81dd7678a69c66f7746cf\",\"lessThan\":\"d6a6aa81eac2c9bff66dc6e191179cb69a14426b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/mgmt/user_config.c\",\"fs/smb/server/transport_ipc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.141\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.84\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.25\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.2\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.12.84\",\"matchCriteriaId\":\"04651641-C387-4546-B02F-17BA989CC253\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.25\",\"matchCriteriaId\":\"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.2\",\"matchCriteriaId\":\"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bf396208418371174869baba9434535cd3288e80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:27:40+00:00",
      "cve": "CVE-2026-31707",
      "id": "CVE-2026-31707",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: validate response sizes in ipc_validate_msg()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31707.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:23:37Z",
      "cve": "CVE-2026-31707",
      "id": "CVE-2026-31707",
      "initial_release_date": "2026-05-02T01:25:23Z",
      "product_status:known_not_affected": "291",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31707",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31707.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.