CVE-2026-31476

Root

Cause

In the Linux kernel's ksmbd SMB server, when a multichannel session binding request fails (e.g., due to a wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, the sess pointer refers to the target session looked up via ksmbd_session_lookup_slowpath(), which belongs to another connection's user. This means that a failure in the binding process inadvertently targets a session that is not owned by the requesting connection.

Exploitation

An attacker can exploit this vulnerability by sending a crafted multichannel binding request with an incorrect password to the ksmbd server. No authentication is required because the binding request occurs before session establishment. By doing so, the attacker can cause any active session (looked up via the binding request) to be expired, leading to a denial of service for that session's user.

Impact

Successful exploitation allows a remote, unauthenticated attacker to forcibly expire any active SMB session on the server. This effectively disconnects legitimate users, causing a denial of service. The vulnerability does not require any special privileges or network position beyond the ability to send SMB binding requests to the target server.

Mitigation

The fix is to skip session expiration when the failed request is a binding attempt, as the session does not belong to the current connection. This patch has been applied to the Linux kernel stable tree via commits [1][2][3][4]. Users should update to a patched kernel version.