CVE-2026-31476 (GCVE-0-2026-31476)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-08-05 12:22
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: do not expire session on binding failure When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() -- which belongs to another connection's user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS). Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put().
References
Impacted products
Vendor Product Version
Linux Linux Version: f5a544e3bab78142207e0242d22442db85ba1eff
Version: f5a544e3bab78142207e0242d22442db85ba1eff
Version: f5a544e3bab78142207e0242d22442db85ba1eff
Version: f5a544e3bab78142207e0242d22442db85ba1eff
Version: f5a544e3bab78142207e0242d22442db85ba1eff
Version: f5a544e3bab78142207e0242d22442db85ba1eff
Version: f5a544e3bab78142207e0242d22442db85ba1eff
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4642ea35c03cf3d3558c009df4757cdb7af3f82d",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "f5300690c23c5ac860499bb37dbc09cf43fd62e6",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "6fafc4c4238e538969f1375f9ecdc6587c53f1cc",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "1d1888b4a7aec518b707f6eca0bf08992c0e8da3",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "a897064a457056acb976e20e3007cdf553de340f",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "e0e5edc81b241c70355217de7e120c97c3429deb",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "9bbb19d21ded7d78645506f20d8c44895e3d0fb9",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: do not expire session on binding failure\n\nWhen a multichannel session binding request fails (e.g. wrong password),\nthe error path unconditionally sets sess-\u003estate = SMB2_SESSION_EXPIRED.\nHowever, during binding, sess points to the target session looked up via\nksmbd_session_lookup_slowpath() -- which belongs to another connection\u0027s\nuser. This allows a remote attacker to invalidate any active session by\nsimply sending a binding request with a wrong password (DoS).\n\nFix this by skipping session expiration when the failed request was\na binding attempt, since the session does not belong to the current\nconnection. The reference taken by ksmbd_session_lookup_slowpath() is\nstill correctly released via ksmbd_user_session_put()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is an in-kernel SMB server reachable over TCP, commonly on port 445, and the vulnerable path is reached by remote SMB2 SESSION_SETUP traffic. The binding failure is processed from network-supplied SMB packets.\nAC:L - With SMB3 multichannel enabled and an active target session, the attacker can trigger the flaw by sending a binding SESSION_SETUP request that fails authentication. There is no race or memory-layout dependency, and uncertainty about required protocol identifiers is resolved toward the higher-severity low-complexity value.\nPR:N - SMB2 SESSION_SETUP is explicitly exempt from the normal authenticated session check, and the bug is triggered on the failed authentication path before attacker credentials are accepted. The code checks the signed flag but does not cryptographically validate the binding request before expiring the looked-up session.\nUI:N - The attacker sends network SMB requests directly to the ksmbd service. No victim action is required during exploitation beyond the existence of an active SMB session to disrupt.\nS:U - The impact remains within the same kernel/ksmbd server security authority. It does not cross a VM, sandbox, IOMMU, or other separate authorization boundary.\nC:N - The bug changes session state but does not expose memory, file contents, credentials, or other confidential data. No information disclosure primitive was found.\nI:L - The attacker can cause an unauthorized change to a security-relevant server-side session object by forcing another session into SMB2_SESSION_EXPIRED. This is limited state modification, not arbitrary write or code execution.\nA:H - The vulnerable code invalidates active SMB sessions belonging to other connections, disrupting their file/service access. Repeating the unauthenticated network trigger can deny ksmbd service availability to active clients."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:55.000Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4642ea35c03cf3d3558c009df4757cdb7af3f82d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5300690c23c5ac860499bb37dbc09cf43fd62e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fafc4c4238e538969f1375f9ecdc6587c53f1cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d1888b4a7aec518b707f6eca0bf08992c0e8da3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a897064a457056acb976e20e3007cdf553de340f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0e5edc81b241c70355217de7e120c97c3429deb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bbb19d21ded7d78645506f20d8c44895e3d0fb9"
        }
      ],
      "title": "ksmbd: do not expire session on binding failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31476",
    "datePublished": "2026-04-22T13:54:04.779Z",
    "dateReserved": "2026-03-09T15:48:24.098Z",
    "dateUpdated": "2026-08-05T12:22:55.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.