Critical ksmbd OOB fix never reached Linux 5.15 stable
CVE-2026-31705, a CVSS 9.8 out-of-bounds write in SMB extended-attribute handling, was backported to six later stables but omitted from still-maintained 5.15.
A critical out-of-bounds write fix for the Linux kernel's in-kernel SMB server, ksmbd, never reached the 5.15 stable series, despite landing on six newer stable and long-term branches.
CVE-2026-31705 is an unauthenticated, network-reachable flaw in extended-attribute response construction. When building the reply, alignment padding can run after a value that already consumes the remaining buffer space. In compound requests the shared response buffer can be left with a tight remainder, so the padding write steps past the allocation into adjacent kernel heap. The CNA scores it 9.8 critical (high impact on confidentiality, integrity, and availability).
The upstream fix arrived in April 2026 and was backported to 6.1, 6.6, 6.12, 6.18, and the 7.x stables. Mohammed Omran reported on the stable kernel list that 5.15 still carries the vulnerable shape through 5.15.225. The CVE affected table records the bug as introduced into 5.15 and fixed on every later tracked line, with no fix bound for 5.15 itself. Related out-of-bounds corrections in the same query-info family did reach 5.15; only the extended-attribute case was left behind. The remedy is a bounds check that skips padding when it will not fit.
Omran has asked stable maintainers to queue the one-line backport for 5.15.y.