CVE-2026-31392
SMB Session Reuse Vulnerability in Linux Kernel CIFS Client
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| samba | cifs-utils | 4.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's SMB client when using Kerberos (krb5) mounts with the username option. The client incorrectly reuses an existing SMB session from a previous mount even when a different username is specified for a new mount. This causes the client to attempt mounting shares with wrong credentials.
The issue arises because the client does not properly match the username option when establishing a new session with Kerberos authentication, leading to incorrect reuse of sessions. The fix involves ensuring that the username mount option is matched correctly in the session matching function, preventing reuse of sessions with different usernames.
How can this vulnerability impact me? :
This vulnerability can cause mounts to fail or succeed incorrectly by using wrong credentials. Specifically, it may allow a client to reuse an SMB session authenticated with one username to access shares intended for a different username, potentially leading to authentication errors or unauthorized access attempts.
In practical terms, this means that when mounting multiple SMB shares with different usernames using Kerberos authentication, the client might not properly isolate sessions per username, causing access failures or security issues related to credential reuse.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if SMB mounts using the sec=krb5 option with different username= options are incorrectly reusing the same SMB session, leading to mount failures or incorrect credential usage.
One way to detect this is by mounting CIFS shares with different usernames and verifying if the mounts are using the correct credentials or if the session is being reused improperly.
Example commands to test this behavior include:
- Use ktutil to add entries to the keytab and verify them with klist -ke.
- Mount CIFS shares with different usernames using mount.cifs with options sec=krb5 and username=.
- Check the mounted shares and their usernames with: mount -t cifs | grep -Po 'username=\K\w+'.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed by ensuring that the username mount option is matched in the SMB session even when using Kerberos (sec=krb5).
To mitigate this vulnerability immediately, update your Linux kernel and cifs-utils package to versions that include this fix (cifs-utils-4.8 or later).
Ensure that your mounts using sec=krb5 with different username options do not reuse SMB sessions incorrectly by applying the patch or updated software.