CVE-2026-31409: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31409 is an authorization bypass vulnerability in the Linux kernel's ksmbd SMB2 server implementation, caused by a failure to clear the conn->binding flag on a failed multichannel SMB2_SESSION_SETUP binding request. When a session setup with SMB2_SESSION_REQ_FLAG_BINDING fails, the connection is left in a persistent binding state, causing all subsequent ksmbd_session_lookup_all() calls to fall back to the global sessions table rather than the per-connection table. This allows an authenticated SMB2 client to access sessions belonging to other users on the same multichannel connection. Affected Linux kernel versions span 5.15 through pre-patch releases across multiple stable branches. It was published on April 6, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-390 (Detection of Error Condition Without Action): when a multichannel SMB2_SESSION_SETUP request with the SMB2_SESSION_REQ_FLAG_BINDING flag fails, ksmbd sets conn->binding = true but never resets it to false on the error path. This leaves the connection object in an incorrect state, causing the session lookup function ksmbd_session_lookup_all() to bypass the per-connection session table and query the global sessions table for all subsequent requests on that connection. The fix, applied in the kernel stable tree, adds conn->binding = false in the error path to restore correct state. Exploitation requires network access to the ksmbd service and valid SMB2 credentials, but no elevated privileges beyond a standard authenticated user (GitHub Advisory, Red Hat Bugzilla).

A low-privileged, authenticated SMB2 client can exploit this vulnerability to access, read, modify, or delete SMB session data belonging to other authenticated users sharing the same multichannel connection. The confidentiality, integrity, and availability impacts are all rated High, as an attacker could interact with arbitrary sessions on the server — potentially accessing sensitive files, corrupting data, or disrupting other users' sessions. The scope is limited to the affected ksmbd server instance, but the ability to hijack other users' sessions represents a significant lateral movement risk within shared SMB environments (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires valid SMB2 credentials (low privilege), making it accessible to any authenticated user of the ksmbd service. The EPSS score is 0.0001 (very low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Nessus plugin 305087 (GitHub Advisory, Tenable).

1. Reconnaissance: Identify Linux systems running ksmbd (the in-kernel SMB2 server) on the network, typically listening on TCP port 445. Confirm the kernel version falls within the affected range (5.15–6.1.x before 6.1.167, 6.2–6.6.x before 6.6.130, 6.7–6.12.x before 6.12.78, 6.13–6.18.x before 6.18.20, or 6.19.x before 6.19.10).
2. Authenticate: Obtain valid SMB2 credentials for the target ksmbd server (any low-privileged account suffices).
3. Establish multichannel connection: Connect to the ksmbd server using an SMB2 client that supports multichannel, establishing an initial session.
4. Send failing binding request: Send a crafted SMB2_SESSION_SETUP request with the SMB2_SESSION_REQ_FLAG_BINDING flag set, intentionally causing the binding to fail (e.g., by using an invalid or mismatched session ID). This sets conn->binding = true on the server without clearing it on failure.
5. Exploit persistent binding state: With the connection now stuck in the binding state, issue subsequent SMB2 session lookup requests. The server's ksmbd_session_lookup_all() will fall back to the global sessions table, exposing sessions of other authenticated users.
6. Access other users' sessions: Interact with the exposed sessions to read, modify, or delete files and data accessible under those sessions (GitHub Advisory).

• Network: Unusual or repeated SMB2_SESSION_SETUP requests with the SMB2_SESSION_REQ_FLAG_BINDING flag from a single client IP, particularly requests that result in errors; unexpected multichannel SMB2 traffic patterns from clients not typically using multichannel.
• Logs: ksmbd server logs showing repeated failed session binding attempts followed by successful session lookups from the same connection; anomalous session activity where a single connection accesses resources associated with multiple distinct user accounts.
• Process: Unexpected file access or modification events on the ksmbd host attributed to sessions that do not match the expected user-to-resource mapping; audit logs showing cross-user file access via SMB.

Apply the upstream Linux kernel patches, which are available in stable releases 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10 (and later), as well as kernel 7.0-rc5 and above. As a temporary workaround, restrict SMB2 (TCP port 445) access to trusted networks and authenticated users only, and consider disabling ksmbd multichannel support if not required. Prioritize patching systems where ksmbd is exposed to untrusted or multi-tenant network environments (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received standard automated coverage across CVE tracking platforms and security feeds shortly after publication on April 6, 2026. Red Hat tracked the issue via Bugzilla and the GitHub Security Advisory database published a corresponding GHSA entry. Tenable added detection support via Nessus plugin 305087. No notable independent researcher commentary or significant media coverage beyond routine CVE reporting has been observed (GitHub Advisory, Tenable).