CVE-2026-31476: Linux Kernel ksmbd DoS Vulnerability

CVE-2026-31476 Overview

A vulnerability has been discovered in the Linux kernel's ksmbd (in-kernel SMB3 server) component that allows remote attackers to invalidate any active session through a specially crafted multichannel session binding request. When a binding request fails due to incorrect credentials, the error handling path incorrectly sets sess->state = SMB2_SESSION_EXPIRED on a session that belongs to a different connection's user. This logic flaw enables unauthenticated denial of service attacks against legitimate SMB sessions.

Critical Impact
Remote attackers can invalidate any active ksmbd session by sending a binding request with an incorrect password, causing denial of service for legitimate users without requiring authentication.

Affected Products

Linux Kernel with ksmbd enabled
Linux distributions utilizing in-kernel SMB3 server functionality
Enterprise file servers running ksmbd for SMB/CIFS services

Discovery Timeline

2026-04-22 - CVE CVE-2026-31476 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31476

Vulnerability Analysis

The vulnerability exists in the ksmbd session handling logic during multichannel session binding operations. When a multichannel session binding request is processed, the ksmbd module uses ksmbd_session_lookup_slowpath() to look up the target session. This function returns a reference to a session that may belong to another connection's user.

If the binding request fails for any reason (such as providing an incorrect password), the error handling code unconditionally marks the session as expired by setting sess->state = SMB2_SESSION_EXPIRED. The critical flaw is that during a binding operation, the sess pointer references the looked-up target session rather than a session owned by the current connection. This means an attacker can deliberately fail authentication to expire sessions belonging to other users.

The reference acquired by ksmbd_session_lookup_slowpath() is properly released via ksmbd_user_session_put(), but the session state corruption has already occurred before this cleanup, rendering legitimate user sessions invalid.

Root Cause

The root cause is improper state management in the error handling path of the SMB2 session binding logic. The code fails to distinguish between binding failures (where the session belongs to another connection) and regular authentication failures (where the session belongs to the current connection). By unconditionally expiring the session on any failure, the code inadvertently allows cross-connection session invalidation.

The fix addresses this by adding a conditional check that skips session expiration when the failed request was a binding attempt, since in that case the session does not belong to the current connection and should not be modified.

Attack Vector

The attack can be executed remotely over the network by any attacker who can reach the ksmbd service. The attack involves:

Identifying a target system running ksmbd with active SMB sessions
Initiating a multichannel session binding request to the target
Deliberately providing incorrect credentials to trigger authentication failure
The error path invalidates the target session, disconnecting the legitimate user

This attack is particularly dangerous because it requires no valid credentials and can be executed against any active session that the attacker can identify or enumerate. The low complexity and network accessibility make this a practical attack vector for service disruption.

Detection Methods for CVE-2026-31476

Indicators of Compromise

Unexpected SMB session disconnections reported by users
High volume of failed SMB2 session binding requests in ksmbd logs
Repeated authentication failures from unrecognized IP addresses
Unusual patterns of multichannel binding attempts targeting the SMB server

Detection Strategies

Monitor ksmbd logs for failed session binding attempts with invalid credentials
Implement network monitoring to detect anomalous SMB traffic patterns targeting multichannel binding operations
Configure alerts for unexpected session terminations that do not correlate with user activity
Deploy intrusion detection rules to identify reconnaissance and exploitation attempts against SMB services

Monitoring Recommendations

Enable detailed logging for ksmbd authentication events and session state changes
Implement rate limiting on SMB session binding requests from individual source IPs
Monitor for correlation between binding request failures and subsequent session invalidations
Review SMB server access logs regularly for suspicious authentication patterns

How to Mitigate CVE-2026-31476

Immediate Actions Required

Apply the kernel patches that address the session expiration logic flaw
Restrict network access to ksmbd services using firewall rules to trusted IP ranges
Consider temporarily disabling multichannel functionality if patches cannot be immediately applied
Monitor active sessions for unexpected disconnections indicating potential exploitation

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix modifies the error handling path to skip session expiration when the failed request was a binding attempt. Patches are available through the following kernel commits:

Update to a patched kernel version through your distribution's package management system.

Workarounds

Restrict access to ksmbd services using network-level controls such as firewall rules or VPN requirements
Disable the ksmbd module if SMB services are not required and use Samba in user-space as an alternative
Implement network segmentation to limit exposure of SMB services to untrusted networks
Enable SMB signing and encryption to add authentication requirements for SMB traffic

bash

# Restrict ksmbd access via iptables (example)
iptables -A INPUT -p tcp --dport 445 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j DROP

# Or disable ksmbd module if not needed
modprobe -r ksmbd
echo "blacklist ksmbd" >> /etc/modprobe.d/blacklist.conf