{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-31392 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-31392 is a high-severity authentication bypass vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-31392 and fix it if it is affected.\n\nWhat it is: CVE-2026-31392 is a high-severity authentication bypass vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-31392 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-31392/ (Markdown: https://insights.sbomify.com/CVE-2026-31392/index.md)","id":"CVE-2026-31392","markdown":"https://insights.sbomify.com/CVE-2026-31392/index.md","name":"CVE-2026-31392","record":{"aliases":["BELL-CVE-2026-31392","DEBIAN-CVE-2026-31392","GHSA-h833-487p-56g8","ROOT-OS-DEBIAN-11-CVE-2026-31392","ROOT-OS-DEBIAN-12-CVE-2026-31392","ROOT-OS-DEBIAN-13-CVE-2026-31392","ROOT-OS-UBUNTU-2204-CVE-2026-31392","ROOT-OS-UBUNTU-2404-CVE-2026-31392","UBUNTU-CVE-2026-31392"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["privilege_escalation","data_read"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel SMB client","requires_auth":"high_privilege","summary":"The Linux kernel SMB client incorrectly reuses Kerberos sessions, allowing mounts with different usernames to bypass authentication checks.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix krb5 mount with username option\n\nCustomer reported that some of their krb5 mounts were failing against\na single server as the client was trying to mount the shares with\nwrong credentials.  It turned out the client was reusing SMB session\nfrom first mount to try mounting the other shares, even though a\ndifferent username= option had been specified to the other mounts.\n\nBy using username mount option along with sec=krb5 to search for\nprincipals from keytab is supported by cifs.upcall(8) since\ncifs-utils-4.8.  So fix this by matching username mount option in\nmatch_session() even with Kerberos.\n\nFor example, the second mount below should fail with -ENOKEY as there\nis no 'foobar' principal in keytab (/etc/krb5.keytab).  The client\nends up reusing SMB session from first mount to perform the second\none, which is wrong.\n\n```\n$ ktutil\nktutil:  add_entry -password -p testuser -k 1 -e aes256-cts\nPassword for testuser@ZELDA.TEST:\nktutil:  write_kt /etc/krb5.keytab\nktutil:  quit\n$ klist -ke\nKeytab name: FILE:/etc/krb5.keytab\nKVNO Principal\n ---- ----------------------------------------------------------------\n   1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96)\n$ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser\n$ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar\n$ mount -t cifs | grep -Po 'username=\\K\\w+'\ntestuser\ntestuser\n```","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"smb: client: fix krb5 mount with username option","id":"CVE-2026-31392","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access","id":"CVE-2026-31393"},"packages":[],"prev":{"headline":"crypto: atmel-sha204a - Fix OOM -\u003etfm_count leak","id":"CVE-2026-31391"},"products":["Linux"],"published":"2026-04-03","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"The Linux kernel SMB client incorrectly reuses Kerberos sessions, allowing mounts with different usernames to bypass authentication checks.","url":"https://insights.sbomify.com/CVE-2026-31392/"}