CVE-2026-31717 ksmbd: validate owner of durable handle on reconnect
An authenticated user can hijack orphaned durable file handles in the Linux kernel ksmbd server, allowing unauthorized access to files opened by other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31717?
CVE-2026-31717 is a high-severity missing authorization vulnerability in Linux kernel, published on 1 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate owner of durable handle on reconnect
Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID.
According to MS-SMB2, the server MUST verify that the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open. Add a durable_owner structure to ksmbd_file to store the original opener's UID, GID, and account name. and catpure the owner information when a file handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner() to validate the identity of the requester during SMB2_CREATE (DHnC).
Which versions are affected by CVE-2026-31717?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31717?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-31717 being exploited?
There is no known exploitation of CVE-2026-31717 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31717, DEBIAN-CVE-2026-31717, GHSA-ffmp-v5q6-mvpq, ROOT-OS-DEBIAN-13-CVE-2026-31717, UBUNTU-CVE-2026-31717.