CVE-2026-31710: Linux Kernel SMB1 Path Separator Flaw

CVE-2026-31710 Overview

CVE-2026-31710 is a kernel vulnerability in the Linux SMB client affecting SMB1 UNIX mounts. The flaw resides in the cifs_mount_get_tcon() code path, where cifs_sb->mnt_cifs_flags is read or updated before reset_cifs_unix_caps() executes. This ordering bug results in the CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS flag bits being absent from cifs_sb_info::mnt_cifs_flags. The missing CIFS_MOUNT_POSIX_PATHS bit causes the SMB client to use the wrong directory separator in path handling. The issue affects Linux kernel version 7.0 and several rc candidates and was resolved upstream through patches c4d3fc58 and fbbfcf35.

Critical Impact
A local, low-privileged user interacting with SMB1 UNIX mounts can trigger high-impact availability degradation in the kernel SMB client.

Affected Products

Linux Kernel version 7.0
Linux Kernel 7.0 release candidates rc2 through rc7
Systems mounting SMB1 shares with UNIX extensions enabled

Discovery Timeline

2026-05-01 - CVE-2026-31710 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31710

Vulnerability Analysis

The vulnerability is a kernel-level logic flaw in the Common Internet File System (CIFS) client implementation under fs/smb/client/. When mounting an SMB1 share with UNIX extensions, the function cifs_mount_get_tcon() orchestrates the negotiation of POSIX capabilities through reset_cifs_unix_caps(). The function reset_cifs_unix_caps() is responsible for setting the CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS flag bits within the per-superblock structure cifs_sb_info::mnt_cifs_flags. The defect arises because callers read or update mnt_cifs_flags prior to reset_cifs_unix_caps() completing. As a result, the POSIX path handling state observed by the caller does not reflect the negotiated UNIX capabilities. Path resolution then defaults to the SMB-style backslash separator instead of the UNIX-style forward slash, causing path operations to fail or behave incorrectly on UNIX-extension-aware servers.

Root Cause

The root cause is incorrect operation ordering [CWE-NVD-noinfo] in the SMB1 UNIX mount path. The flag field mnt_cifs_flags was being consulted before reset_cifs_unix_caps() populated the POSIX capability bits, producing a stale or incomplete view of the mount configuration.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker mounting or interacting with an SMB1 UNIX share can trigger the inconsistent flag state. The impact is limited to availability — confidentiality and integrity are not affected — and manifests as incorrect path handling that disrupts file operations on the affected mount. No public proof-of-concept or exploitation in the wild has been reported.

No verified code examples are available for this vulnerability. Refer to the upstream commits Kernel Git Commit c4d3fc5 and Kernel Git Commit fbbfcf3 for the exact source-level fix.

Detection Methods for CVE-2026-31710

Indicators of Compromise

Kernel log entries from the cifs module reporting failed path operations on SMB1 UNIX mounts.
Userspace applications reporting ENOENT or path resolution errors when accessing files on SMB1 shares with UNIX extensions enabled.
Mounted SMB1 shares where directory traversal uses \ separators instead of / despite the server advertising UNIX capabilities.

Detection Strategies

Inventory running kernel versions across Linux fleets and flag any host running Linux kernel 7.0 or its release candidates with the cifs.ko module loaded.
Audit /proc/mounts and mount output for filesystems of type cifs using vers=1.0 or SMB1 with posixpaths semantics.
Correlate SMB1 mount events with subsequent path-resolution failures in dmesg and application logs.

Monitoring Recommendations

Monitor kernel ring buffer messages from the cifs and smb subsystems for capability negotiation anomalies.
Track usage of legacy SMB1 protocol mounts in the environment and flag for migration to SMB2 or SMB3.
Alert on repeated mount or remount activity targeting SMB1 UNIX shares from unprivileged users.

How to Mitigate CVE-2026-31710

Immediate Actions Required

Apply the upstream kernel patches c4d3fc58 and fbbfcf35 or upgrade to a stable kernel that includes both fixes.
Disable SMB1 protocol usage where possible and migrate clients to SMB2 or SMB3 with native POSIX extensions where supported.
Restrict the ability of unprivileged users to mount arbitrary SMB1 UNIX shares through /etc/fstab policies and mount namespace constraints.

Patch Information

The Linux kernel maintainers resolved CVE-2026-31710 by reordering the read and update of cifs_sb->mnt_cifs_flags to occur only after reset_cifs_unix_caps() has completed. This ensures the CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits are correctly reflected before any path resolution decisions are made. The fixes are available in commits c4d3fc5844d6 and fbbfcf35e1ee.

Workarounds

Avoid mounting SMB1 shares with UNIX extensions until kernel patches are applied.
Use SMB2 or SMB3 with the mfsymlinks or native POSIX extensions where the server supports them.
Limit who can issue mount.cifs operations through sudo policy controls and remove the setuid bit from mount.cifs where not required.

bash

# Configuration example: blacklist SMB1 and verify kernel version
uname -r
modprobe -r cifs
echo 'install cifs /bin/false' | sudo tee /etc/modprobe.d/disable-smb1.conf