CVE-2026-31532

The Linux kernel's SMB1 client parses length and offset fields from synchronous read responses before confirming that the complete response header was received. A malicious or compromised SMB1 server can return a truncated response that causes the client to read beyond its receive buffer.

The Linux kernel's SMB1 client fails to validate a server-supplied data offset before copying a synchronous read response. A malicious or compromised SMB1 server can make the client read beyond the received response buffer, potentially disclosing adjacent kernel heap data or crashing the system.

GNOME Remote Desktop does not enforce a deadline for unauthenticated clients to complete the RDP handshake. A remote attacker can hold admitted connections open indefinitely, exhaust the service's global connection limit, and prevent new RDP clients from connecting until a holding socket is closed.