CVE-2026-31409 ksmbd: unset conn->binding on failed binding request
A logic error in the Linux kernel's ksmbd server fails to reset a binding flag, potentially allowing unauthorized access to session data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31409?
CVE-2026-31409 is a high-severity vulnerability in Linux kernel, published on 6 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: unset conn->binding on failed binding request
When a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbd_session_lookup_all() calls fall back to the global sessions table. This fix it by clearing conn->binding = false in the error path.
Which versions are affected by CVE-2026-31409?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31409?
Apply the vendor's patch.
Is CVE-2026-31409 being exploited?
There is no known exploitation of CVE-2026-31409 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31409, DEBIAN-CVE-2026-31409, GHSA-5qj3-gjq7-62fm, ROOT-OS-DEBIAN-11-CVE-2026-31409, ROOT-OS-DEBIAN-12-CVE-2026-31409, ROOT-OS-DEBIAN-13-CVE-2026-31409 and 3 more.