CVE-2026-31708

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL

and the default QUERY_INFO path. The QUERY_INFO branch clamps

qi.input_buffer_length to the server-reported OutputBufferLength and then

copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but

it never verifies that the flexible-array payload actually fits within

rsp_iov[1].iov_len.

A malicious server can return OutputBufferLength larger than the actual

QUERY_INFO response, causing copy_to_user() to walk past the response

buffer and expose adjacent kernel heap to userspace.

Guard the QUERY_INFO copy with a bounds check on the actual Buffer

payload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)

rather than an open-coded addition so the guard cannot overflow on

32-bit builds.