|
Vulnerabilities
< Back

CVE-2026-31476

Updated on 22 Apr 2026

Severity

8.2 High severity

Details

CVSS score
8.2
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: do not expire session on binding failure

When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() – which belongs to another connection’s user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS).

Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put().

Details

Affected product:
Ubuntu 20.04 ELS
Affected packages:
linux @ 5.4.0 (+1 more)

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 12 Released
35 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
Debian 13 Planned —
Ubuntu 22.04 Planned —
Ubuntu 24.04 Planned —