CVE-2026-31392

CVE-2026-31392 describes a vulnerability in the Linux kernel's CIFS/SMB client. The bug resides in the match_session() function, which did not consider the username= mount option when matching existing sessions for Kerberos-authenticated mounts (sec=krb5). As a result, if a user mounts a share with one username, subsequent mounts to the same server with a different username would incorrectly reuse the initial session, using the first username's credentials [1].

To exploit this, an attacker would need the ability to mount a CIFS share with Kerberos authentication and specify a different username. No additional authentication is required beyond the initial mount. The client would then bypass the intended keytab lookup for the second username, effectively ignoring the username= option. The example in the description shows two mounts, one with username=testuser and another with username=foobar, both ending up with the same testuser credentials.

The impact is improper authentication: a user can gain access to a share that should require different credentials (e.g., a non-existent principal), potentially leading to unauthorized data access or privilege escalation. The issue was reported by customers experiencing failed mounts with wrong credentials.

The fix, which adds the username option to the session matching logic for Kerberos, has been applied to the stable Linux kernel branches [1]. Users are advised to update their kernels to include the patched version.