CVE-2026-31392: Linux Kernel Kerberos Auth Bypass Flaw

CVE-2026-31392 Overview

CVE-2026-31392 is a Linux kernel vulnerability in the SMB client implementation. The flaw affects how the kernel handles Kerberos (krb5) mounts when paired with the username= mount option. The SMB client incorrectly reuses an existing SMB session from a prior mount instead of authenticating with the credentials specified for the new mount. This causes subsequent mounts to operate under the wrong principal, breaking authentication isolation between mount points on the same server.

Critical Impact

A local user with mount privileges can cause SMB shares to be accessed under a different Kerberos principal than requested, leading to unauthorized access to data and integrity issues across mounted shares.

Affected Products

• Linux kernel SMB client (fs/smb/client) with sec=krb5 and username= mount options
• Systems using cifs-utils 4.8 or later with cifs.upcall(8) keytab principal lookup
• Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

• 2026-04-03 - CVE-2026-31392 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31392

Vulnerability Analysis

The vulnerability resides in the SMB client session matching logic inside match_session(). When the kernel mounts an SMB share, it attempts to reuse existing SMB sessions to the same server for efficiency. The matching function did not factor the username= mount option into its comparison when sec=krb5 was in use. As a result, two mounts targeting the same server with different username= values would share a single SMB session bound to whichever principal authenticated first.

The practical effect is credential confusion. A second mount specifying username=foobar with no matching keytab principal should fail with -ENOKEY. Instead, it succeeds by piggybacking on the first mount's session as testuser. This breaks the security boundary that administrators expect when separating mount points by identity.

Root Cause

Support for resolving Kerberos principals from a keytab using the username= option was added to cifs.upcall(8) in cifs-utils-4.8. The kernel-side session matcher was not updated to treat username= as a distinguishing attribute when sec=krb5 was specified. The fix adds username comparison to match_session() so Kerberos-authenticated sessions are no longer pooled across different principal identities.

Attack Vector

Exploitation requires local privileges sufficient to invoke mount.cifs against an SMB server. An attacker or unprivileged process able to trigger mounts can cause shares to be accessed under credentials belonging to a previously mounted user. This results in scope change because operations performed on the second mount carry the authority of the first principal, affecting confidentiality and integrity of data on the SMB server.

The vulnerability is described in prose because the upstream fix is a kernel patch rather than a reproducible exploit. See the kernel commits 12b4c5d, 6e9ff1e, 9229709, 9ee803b, d33cbf0, and fd45478 for the canonical fix.

Detection Methods for CVE-2026-31392

Indicators of Compromise

• SMB mounts where mount -t cifs output shows a username= value that differs from the principal recorded in SMB server access logs.
• Successful access to SMB shares from a host whose keytab (/etc/krb5.keytab) lacks the principal named in the mount command.
• Multiple concurrent CIFS mounts to the same server with distinct username= options resolving to a single SMB session ID in /proc/fs/cifs/DebugData.

Detection Strategies

• Audit kernel and cifs-utils versions across Linux fleet to identify hosts running pre-patch kernels with cifs-utils >= 4.8.
• Cross-reference mount tables with SMB server authentication logs to detect mismatches between requested username= and the principal that authenticated.
• Monitor auditd for mount syscalls invoking sec=krb5,username= and correlate against expected mount baselines.

Monitoring Recommendations

• Enable verbose CIFS logging through /proc/fs/cifs/cifsFYI in test environments to confirm session reuse behavior.
• Forward SMB server-side Kerberos authentication events to a centralized log platform for correlation with client mount telemetry.
• Alert on repeated successful mounts to the same server with varying username= values from a single host within a short interval.

How to Mitigate CVE-2026-31392

Immediate Actions Required

• Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds are available.
• Inventory Linux hosts using CIFS/SMB mounts with sec=krb5 and prioritize patching multi-tenant or shared systems.
• Restrict mount privileges to trusted administrators until patches are deployed.

Patch Information

The fix updates match_session() in the SMB client to include the username= mount option in comparison logic even when Kerberos authentication is in use. Reference commits: Kernel Git Commit 12b4c5d, Kernel Git Commit 6e9ff1e, Kernel Git Commit 9229709, Kernel Git Commit 9ee803b, Kernel Git Commit d33cbf0, and Kernel Git Commit fd45478.

Workarounds

• Avoid mounting multiple SMB shares from the same server with differing username= values on the same client until the kernel is patched.
• Where multiple identities are required, mount from separate hosts or unmount existing sessions before initiating a mount under a different principal.
• Validate keytab contents with klist -ke /etc/krb5.keytab and only mount with principals known to exist in the keytab to reduce silent credential reuse.

# Verify SMB session reuse behavior on a host
cat /proc/fs/cifs/DebugData | grep -E 'SessionId|User'

# Unmount existing CIFS sessions before re-mounting under a new principal
umount /mnt/1 && umount /mnt/2
mount.cifs //server/share /mnt/1 -o sec=krb5,username=testuser