CVE-2026-31476
Received Received - Intake
Denial of Service via Session Expiration in Linux ksmbd

Publication date: 2026-04-22

Last updated on: 2026-04-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: do not expire session on binding failure When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() -- which belongs to another connection's user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS). Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put().
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-22
Last Modified
2026-04-27
Generated
2026-05-06
AI Q&A
2026-04-22
EPSS Evaluated
2026-05-05
NVD
CVE-2026-31476
EUVD
EUVD-2026-24831
Affected Vendors & Products
Showing 13 associated CPEs
Vendor Product Version / Range
linux linux_kernel 5.15
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.21 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.11 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.131 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.80 (exc)
linux linux_kernel From 5.15.1 (inc) to 6.1.168 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's ksmbd component, where a failure in a multichannel session binding request (such as providing a wrong password) causes the system to incorrectly expire an active session.

Specifically, when a binding request fails, the error handling code sets the session state to SMB2_SESSION_EXPIRED unconditionally. However, the session being expired actually belongs to another user's connection, not the one making the request.

This flaw allows a remote attacker to invalidate any active session by sending a binding request with an incorrect password, effectively causing a denial of service (DoS) by expiring sessions they do not own.


How can this vulnerability impact me? :

This vulnerability can impact you by allowing a remote attacker to disrupt your active sessions on the Linux kernel's ksmbd service.

By sending a binding request with a wrong password, an attacker can cause your active sessions to be expired unexpectedly, resulting in denial of service (DoS). This means legitimate users may lose access or experience interruptions in service.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability is resolved by a fix in the Linux kernel's ksmbd component that prevents session expiration on binding failure.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart