CVE-2026-31476

Summary

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: do not expire session on binding failure

When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() – which belongs to another connection's user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS).

Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put().

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxf5a544e3bab78142207e0242d22442db85ba1eff < 4642ea35c03cf3d3558c009df4757cdb7af3f82daffected
LinuxLinuxf5a544e3bab78142207e0242d22442db85ba1eff < f5300690c23c5ac860499bb37dbc09cf43fd62e6affected
LinuxLinuxf5a544e3bab78142207e0242d22442db85ba1eff < 6fafc4c4238e538969f1375f9ecdc6587c53f1ccaffected
LinuxLinuxf5a544e3bab78142207e0242d22442db85ba1eff < 1d1888b4a7aec518b707f6eca0bf08992c0e8da3affected
LinuxLinuxf5a544e3bab78142207e0242d22442db85ba1eff < a897064a457056acb976e20e3007cdf553de340faffected
LinuxLinuxf5a544e3bab78142207e0242d22442db85ba1eff < e0e5edc81b241c70355217de7e120c97c3429debaffected
LinuxLinuxf5a544e3bab78142207e0242d22442db85ba1eff < 9bbb19d21ded7d78645506f20d8c44895e3d0fb9affected
LinuxLinux5.15affected
LinuxLinux0 < 5.15unaffected
LinuxLinux5.15.209 <= 5.15.*unaffected
LinuxLinux6.1.168 <= 6.1.*unaffected
LinuxLinux6.6.131 <= 6.6.*unaffected
LinuxLinux6.12.80 <= 6.12.*unaffected
LinuxLinux6.18.21 <= 6.18.*unaffected
LinuxLinux6.19.11 <= 6.19.*unaffected
LinuxLinux7.0 <= *unaffected

Weaknesses

References