{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31476", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.098Z", "datePublished": "2026-04-22T13:54:04.779Z", "dateUpdated": "2026-08-05T12:22:55.000Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:55.000Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: do not expire session on binding failure\n\nWhen a multichannel session binding request fails (e.g. wrong password),\nthe error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED.\nHowever, during binding, sess points to the target session looked up via\nksmbd_session_lookup_slowpath() -- which belongs to another connection's\nuser. This allows a remote attacker to invalidate any active session by\nsimply sending a binding request with a wrong password (DoS).\n\nFix this by skipping session expiration when the failed request was\na binding attempt, since the session does not belong to the current\nconnection. The reference taken by ksmbd_session_lookup_slowpath() is\nstill correctly released via ksmbd_user_session_put()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - ksmbd is an in-kernel SMB server reachable over TCP, commonly on port 445, and the vulnerable path is reached by remote SMB2 SESSION_SETUP traffic. The binding failure is processed from network-supplied SMB packets.\nAC:L - With SMB3 multichannel enabled and an active target session, the attacker can trigger the flaw by sending a binding SESSION_SETUP request that fails authentication. There is no race or memory-layout dependency, and uncertainty about required protocol identifiers is resolved toward the higher-severity low-complexity value.\nPR:N - SMB2 SESSION_SETUP is explicitly exempt from the normal authenticated session check, and the bug is triggered on the failed authentication path before attacker credentials are accepted. The code checks the signed flag but does not cryptographically validate the binding request before expiring the looked-up session.\nUI:N - The attacker sends network SMB requests directly to the ksmbd service. No victim action is required during exploitation beyond the existence of an active SMB session to disrupt.\nS:U - The impact remains within the same kernel/ksmbd server security authority. It does not cross a VM, sandbox, IOMMU, or other separate authorization boundary.\nC:N - The bug changes session state but does not expose memory, file contents, credentials, or other confidential data. No information disclosure primitive was found.\nI:L - The attacker can cause an unauthorized change to a security-relevant server-side session object by forcing another session into SMB2_SESSION_EXPIRED. This is limited state modification, not arbitrary write or code execution.\nA:H - The vulnerable code invalidates active SMB sessions belonging to other connections, disrupting their file/service access. Repeating the unauthenticated network trigger can deny ksmbd service availability to active clients." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/smb2pdu.c" ], "versions": [ { "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "4642ea35c03cf3d3558c009df4757cdb7af3f82d", "status": "affected", "versionType": "git" }, { "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "f5300690c23c5ac860499bb37dbc09cf43fd62e6", "status": "affected", "versionType": "git" }, { "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "6fafc4c4238e538969f1375f9ecdc6587c53f1cc", "status": "affected", "versionType": "git" }, { "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "1d1888b4a7aec518b707f6eca0bf08992c0e8da3", "status": "affected", "versionType": "git" }, { "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "a897064a457056acb976e20e3007cdf553de340f", "status": "affected", "versionType": "git" }, { "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "e0e5edc81b241c70355217de7e120c97c3429deb", "status": "affected", "versionType": "git" }, { "version": "f5a544e3bab78142207e0242d22442db85ba1eff", "lessThan": "9bbb19d21ded7d78645506f20d8c44895e3d0fb9", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/smb2pdu.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.131" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.80" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.19.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4642ea35c03cf3d3558c009df4757cdb7af3f82d" }, { "url": "https://git.kernel.org/stable/c/f5300690c23c5ac860499bb37dbc09cf43fd62e6" }, { "url": "https://git.kernel.org/stable/c/6fafc4c4238e538969f1375f9ecdc6587c53f1cc" }, { "url": "https://git.kernel.org/stable/c/1d1888b4a7aec518b707f6eca0bf08992c0e8da3" }, { "url": "https://git.kernel.org/stable/c/a897064a457056acb976e20e3007cdf553de340f" }, { "url": "https://git.kernel.org/stable/c/e0e5edc81b241c70355217de7e120c97c3429deb" }, { "url": "https://git.kernel.org/stable/c/9bbb19d21ded7d78645506f20d8c44895e3d0fb9" } ], "title": "ksmbd: do not expire session on binding failure", "x_generator": { "engine": "bippy-1.2.0" } } } }