CVE-2026-31410: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31410 is a vulnerability in the Linux kernel's ksmbd (kernel SMB server) subsystem involving improper handling of volume identifiers in FS_OBJECT_ID_INFORMATION. The flaw arises from inconsistent UUID fallback logic: the code should use sb->s_uuid as the primary volume identifier and fall back to stfs.f_fsid from vfs_statfs() for filesystems that do not expose a UUID. It was published on April 6, 2026, and affects Linux kernel versions 5.15 through 6.12.77, 6.13 through 6.18.19, and 6.19 through 6.19.9, as well as 7.0-rc1 through 7.0-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-166 (Improper Handling of Missing Special Element), specifically the failure to properly handle the absence of a filesystem UUID in the ksmbd SMB server subsystem. When a filesystem does not expose a UUID via sb->s_uuid, the code did not correctly fall back to stfs.f_fsid obtained from vfs_statfs(), resulting in improper volume identification in FS_OBJECT_ID_INFORMATION responses. The attack vector is local, requiring low privileges and no user interaction, meaning a local user with SMB access to the affected system could trigger the condition. Patches are available as kernel commits ce00616bc1df, 3d80ebe6d1b7, c283a6ffe6d5, and 3a64125730ca (GitHub Advisory, Feedly).

The primary impact of this vulnerability is on availability, with a high availability impact score and no confidentiality or integrity impact per the CVSS assessment. Exploitation could cause incorrect volume identification in SMB protocol operations, potentially leading to volume confusion, incorrect file sharing behavior, access control inconsistencies, or denial of service conditions within the ksmbd subsystem. Systems acting as SMB file servers using the Linux kernel's built-in ksmbd are most at risk (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.008% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version: 6.12.78, 6.18.20, 6.19.10, or 7.0-rc5 and later. The fixes are included in kernel commits ce00616bc1df675bfdacc968f2bf7c51f4669227, 3d80ebe6d1b7bc9ad20fd9b0c1a0c56d804f8a0a, c283a6ffe6d5d6e5594d991286b9ce15951572e1, and 3a64125730cabc34fccfbc230c2667c2e14f7308. As a temporary measure, administrators may consider disabling ksmbd/SMB kernel server functionality if it is not required, and should review SMB access controls and monitor for anomalous SMB protocol activity (GitHub Advisory, Feedly).

The vulnerability received routine automated coverage across CVE tracking platforms and security feeds shortly after disclosure, including mentions on Bluesky via CVE notification bots and aggregation by ENISA's EUVD (EUVD-2026-19194). No notable researcher commentary or significant media coverage has been identified beyond standard vulnerability database entries (Feedly).