CVE-2026-31409: ksmbd: unset conn->binding on failed binding request
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: unset conn->binding on failed binding request
When a multichannel SMB2SESSIONSETUP request with SMB2SESSIONREQFLAGBINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbdsessionlookupall() calls fall back to the global sessions table. This fix it by clearing conn->binding = false in the error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ksmbd, unset/clear conn->binding (set to false) on the error path for failed SMB2_SESSION_REQ_FLAG_BINDING handling, so that subsequent ksmbd_session_lookup_all() calls fall back to the global sessions table.
Linux kernel ksmbd conn->binding = false (unset on error path)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31409?
The severity of CVE-2026-31409 is rated as high with a score of 8.8.
How does CVE-2026-31409 affect the Linux kernel?
CVE-2026-31409 affects the Linux kernel by failing to clear the conn->binding flag on failed SMB2_SESSION_SETUP requests.
What types of impacts does CVE-2026-31409 have?
CVE-2026-31409 can lead to connection management issues, specifically affecting authentication and session stability.
How can I fix CVE-2026-31409 in my system?
To fix CVE-2026-31409, update your Linux kernel to the latest version that addresses this vulnerability.
Is CVE-2026-31409 exploitable remotely?
Yes, CVE-2026-31409 is exploitable remotely due to its nature within the SMB protocol.