CVE-2026-31711: Linux Kernel KSMBD DoS Vulnerability

CVE-2026-31711 Overview

CVE-2026-31711 is a memory leak vulnerability in the Linux kernel's ksmbd SMB server module. The flaw resides in ksmbd_tcp_new_connection(), where the active_num_conn counter is not decremented when alloc_transport() returns NULL. Each transport allocation failure permanently consumes a slot from the max_connections pool. An unauthenticated remote attacker can reach this code path through any TCP connection to port 445, eventually exhausting the connection limit and rejecting all subsequent SMB connections until module reload [CWE-401].

Critical Impact
Unauthenticated remote attackers can permanently exhaust the ksmbd connection pool, denying SMB service to all legitimate clients until the kernel module is reloaded.

Affected Products

Linux Kernel (multiple stable branches containing the ksmbd module)
Linux Kernel 6.2 release candidates (rc6, rc7, rc8) and 6.2 final
Systems running ksmbd as an in-kernel SMB server exposed on TCP port 445

Discovery Timeline

2026-05-01 - CVE-2026-31711 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31711

Vulnerability Analysis

The vulnerability exists in the ksmbd SMB server kernel module, which handles incoming TCP connections on port 445. The function ksmbd_kthread_fn() increments active_num_conn before invoking ksmbd_tcp_new_connection() and discards its return value. When alloc_transport() inside that function returns NULL, the socket is released and -ENOMEM is returned, but the counter is never decremented.

A prior fix, commit 77ffbcac4e56, addressed only the kthread_run() failure path. The earlier alloc_transport() == NULL path retained the same leak. Each failed allocation permanently consumes one slot from the max_connections pool. Once cumulative failures reach the configured cap, atomic_inc_return() exceeds the threshold on every subsequent accept, and every new connection is rejected with "Limit the maximum number of connections". The counter only resets on module reload.

Root Cause

The root cause is a missing rollback on the error path. ksmbd_kthread_fn() performs the counter increment, but the alloc_transport() failure branch in ksmbd_tcp_new_connection() exits without mirroring the existing decrement pattern gated on server_conf.max_connections. This is a classic missing release of a resource counter [CWE-401].

Attack Vector

The attack is reachable pre-authentication through any TCP connect to port 445. An unauthenticated remote attacker can drive the host toward memory pressure that makes alloc_transport() fail by holding open many connections with large RFC1002 lengths up to MAX_STREAM_PROT_LEN (0x00FFFFFF). Natural transient allocation failures on a loaded host produce the same drift more slowly. The vulnerability was empirically reproduced on User-Mode Linux (ARCH=um, v7.0-rc7) where a small number of forced allocation failures placed ksmbd into a state where every subsequent connection was rejected.

The vulnerability manifests in the connection acceptance path of ksmbd_tcp_new_connection(). See the upstream kernel commits referenced below for the patch implementing the missing atomic_dec() on the failure branch.

Detection Methods for CVE-2026-31711

Indicators of Compromise

Repeated kernel log entries containing "Limit the maximum number of connections" originating from ksmbd
Legitimate SMB clients receiving connection rejections despite low observed concurrent session counts
Sustained high volume of short-lived TCP connections to port 445 from external sources
Memory pressure events on the host correlating with new SMB connection rejections

Detection Strategies

Monitor dmesg and kernel ring buffer output for ksmbd rejection messages while concurrent session counts remain below max_connections.
Correlate TCP port 445 connection attempt rates with ksmbd rejection events to identify resource exhaustion attempts.
Track kernel allocator failure events (kmalloc / slab failures) on hosts exposing ksmbd to identify conditions that trigger the leak.

Monitoring Recommendations

Alert on any external (non-trusted-subnet) TCP connections to port 445 on hosts running ksmbd.
Baseline normal SMB connection rates and alert on sustained anomalous bursts of incomplete or aborted handshakes.
Monitor for ksmbd service degradation that resolves only after kernel module reload, indicating possible counter exhaustion.

How to Mitigate CVE-2026-31711

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisories and reboot affected hosts.
Restrict TCP port 445 exposure to trusted networks using host firewalls or network segmentation.
If patching is not immediately possible, disable the ksmbd module on hosts where it is not required.

Patch Information

The fix mirrors the existing rollback pattern in ksmbd_kthread_fn(): on the alloc_transport() failure path, active_num_conn is decremented when gated on server_conf.max_connections. Patches are available in the following upstream commits: Kernel Git Commit 283027a, Kernel Git Commit 295a9fc, Kernel Git Commit 6551300, Kernel Git Commit 97f8d26, and Kernel Git Commit fb48185.

Workarounds

Block inbound TCP port 445 at perimeter and host firewalls for any system not required to provide SMB services to external clients.
Reload the ksmbd kernel module to reset the active_num_conn counter when the host enters the rejection state, as a temporary recovery action.
Use an alternative SMB server such as user-space Samba on hosts where kernel patching is delayed.
Apply rate limiting on connections to port 445 using iptables/nftables to slow exhaustion attempts.

bash

# Block external access to ksmbd port 445 with nftables
nft add rule inet filter input tcp dport 445 ip saddr != 10.0.0.0/8 drop

# Reload ksmbd to reset active_num_conn after exhaustion
sudo modprobe -r ksmbd && sudo modprobe ksmbd