CVE-2026-31476: ksmbd: do not expire session on binding failure
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: do not expire session on binding failure
When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2SESSIONEXPIRED. However, during binding, sess points to the target session looked up via ksmbdsessionlookupslowpath() -- which belongs to another connection's user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS).
Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbdsessionlookupslowpath() is still correctly released via ksmbdusersessionput().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31476?
The severity of CVE-2026-31476 has been assessed as medium due to potential session management issues.
How do I fix CVE-2026-31476?
To fix CVE-2026-31476, it is recommended to update to a patched version of the Linux kernel.
What software is affected by CVE-2026-31476?
CVE-2026-31476 affects various versions of the Linux kernel that utilize ksmbd for SMB protocol tasks.
What type of vulnerability is CVE-2026-31476?
CVE-2026-31476 is a session management vulnerability that arises during failure conditions for multichannel session binding.
Can CVE-2026-31476 lead to unauthorized access?
Yes, CVE-2026-31476 could potentially allow unauthorized access if an attacker exploits session management failures.