CVE-2026-31718: 
Chainguard vulnerability analysis and mitigation

CVE-2026-31718 is a use-after-free vulnerability in the Linux kernel's ksmbd (kernel SMB server) subsystem, specifically in the __ksmbd_close_fd() function triggered via the durable file handle scavenger thread. The flaw was published on May 1, 2026, and affects Linux kernel versions 6.6.32 through 6.7 (exclusive), 6.9 through 6.12.84 (exclusive), 6.13 through 6.18.25 (exclusive), 6.19 through 7.0.2 (exclusive), and 7.1-rc1. Patches are available for stable branches at versions 6.12.84, 6.18.25, 7.0.2, and 7.1-rc1. The Feedly-estimated CVSS v3.1 base score is 9.8 (Critical), though the ENISA/EUVD base score is listed as 0.0 pending official NVD scoring (Feedly, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), arising from asymmetric cleanup logic in the ksmbd durable file handle lifecycle (Feedly). When a durable SMB file handle survives a TCP session disconnect (without an SMB2_LOGOFF message), session_fd_check() sets fp->conn = NULL to preserve the handle for reconnection, but fails to clean up byte-range locks on fp->lock_list. When the durable scavenger thread later times out and calls __ksmbd_close_fd(NULL, fp), the lock cleanup loop executes spin_lock(&fp->conn->llist_lock), dereferencing the now-NULL fp->conn pointer against a connection object already freed by ksmbd_tcp_disconnect(). The fix addresses three code paths: safely skipping clist deletion when the list is empty and fp->conn is NULL, removing locks from the old connection's lock_list in session_fd_check(), and re-adding locks to the new connection's lock_list in ksmbd_reopen_durable_fd() (Red Hat Bugzilla, Kernel Patch).

Successful exploitation causes a slab use-after-free kernel crash, resulting in a denial of service (system crash/kernel panic) on the affected host. Because the vulnerability is reachable over the network without authentication, an attacker can remotely crash any Linux system running the ksmbd SMB server with a vulnerable kernel version simply by establishing an SMB session with a durable file handle and then abruptly closing the TCP connection. There is no evidence of confidentiality or integrity impact beyond availability loss at this time (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing (Feedly). The vulnerability is remotely exploitable without authentication (network-accessible SMB service), which lowers the barrier for exploitation significantly. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify Linux hosts running the ksmbd SMB server (typically on TCP port 445) with a vulnerable kernel version using network scanners such as Nmap or Shodan.
2. Establish SMB session: Connect to the target's SMB service and open a file with a durable file handle (SMB2 CREATE request with a durable handle context), which instructs the server to preserve the handle across session disconnects.
3. Trigger asymmetric cleanup: Abruptly close the TCP connection without sending an SMB2_LOGOFF message, causing session_fd_check() to set fp->conn = NULL while leaving byte-range lock entries (smb_lock->clist) dangling on the freed connection's lock_list.
4. Wait for scavenger timeout: Allow the durable scavenger thread to time out (no reconnection within the durable handle timeout period), triggering __ksmbd_close_fd(NULL, fp).
5. Trigger kernel crash: The scavenger's lock cleanup loop dereferences the freed fp->conn pointer via spin_lock(&fp->conn->llist_lock), causing a slab use-after-free and kernel panic (denial of service) (Red Hat Bugzilla, Feedly).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing slab use-after-free errors referencing __ksmbd_close_fd, ksmbd_tcp_disconnect, or spin_lock with a NULL pointer; kernel BUG or OOPS traces involving ksmbd subsystem functions.
• Network: Repeated SMB2 CREATE requests with durable handle contexts (SMB2 CREATE context type DH2Q or DHnQ) from the same source IP followed by abrupt TCP RST or FIN without SMB2_LOGOFF, particularly if repeated in a pattern suggesting automated exploitation.
• Process/System: Unexpected kernel panics or system reboots on hosts running ksmbd; ksmbd worker threads crashing as observed in system logs.
• File System: Core dump files generated by kernel crashes in configured crash dump directories (e.g., /var/crash/) containing ksmbd-related stack traces (Feedly, Red Hat Bugzilla).

Update the Linux kernel to a patched version: 6.12.84 or later (for the 6.12.x stable branch), 6.18.25 or later (for the 6.18.x branch), 7.0.2 or later, or 7.1-rc1 or later (Feedly, Kernel Patch). For systems that cannot be updated immediately, disable the ksmbd kernel module (modprobe -r ksmbd) if SMB server functionality is not required, or restrict network access to TCP port 445 to trusted hosts only using firewall rules. Distribution-specific updates should be monitored from vendors such as Red Hat, openSUSE, and Yocto Project, which have already begun tracking this issue (openSUSE Advisory).

Red Hat has opened a Bugzilla tracking entry (Bug 2464490) and published a security advisory page for this CVE, indicating active tracking for RHEL-based distributions (Red Hat Bugzilla, Red Hat Advisory). The openSUSE security team issued a security announcement to its mailing list, and the Yocto Project security list has referenced the issue across multiple messages. Microsoft's MSRC also published a reference page for this CVE. Social media activity has been limited to automated CVE tracking accounts on Bluesky and Mastodon, with no notable researcher commentary or broader community discussion observed.