CVE-2026-31477

OVERVIEW CVE-2026-31477 is a vulnerability in the Linux kernel's SMB2 locking mechanism (smb2_lock function) affecting the ksmbd subsystem. The vulnerability encompasses multiple error handling flaws that lead to memory leaks and potential NULL pointer dereference conditions when processing lock and unlock requests. SEVERITY The vulnerability carries a CVSS score that is currently unavailable, though the EPSS score of 0.00024 indicates minimal statistical likelihood of exploitation compared to other CVEs. The attack vector requires local access to the affected system, and exploitation would demand moderate complexity. The potential impact includes denial of service through kernel crashes via NULL pointer dereference and memory exhaustion through repeated leak conditions, though no direct remote exploitation path exists. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as this vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog. The vulnerability was identified through automated static analysis (sqry call-graph analysis) rather than in-the-wild exploitation reports. No public exploit code is currently available, and community attention remains minimal given the specialized nature of the ksmbd subsystem and the low EPSS score. The fix has been integrated into the Linux kernel development process through proper patch submission channels.