Vulnerability-Lookup

GHSA-5QJ3-GJQ7-62FM

Vulnerability from github – Published: 2026-04-06 09:31 – Updated: 2026-06-01 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: unset conn->binding on failed binding request

When a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbd_session_lookup_all() calls fall back to the global sessions table. This fix it by clearing conn->binding = false in the error path.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-31409"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-06T08:16:38Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: unset conn-\u003ebinding on failed binding request\n\nWhen a multichannel SMB2_SESSION_SETUP request with\nSMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn-\u003ebinding = true\nbut never clears it on the error path. This leaves the connection in\na binding state where all subsequent ksmbd_session_lookup_all() calls\nfall back to the global sessions table. This fix it by clearing\nconn-\u003ebinding = false in the error path.",
  "id": "GHSA-5qj3-gjq7-62fm",
  "modified": "2026-06-01T18:31:23Z",
  "published": "2026-04-06T09:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31409"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/282343cf8a4a5a3603b1cb0e17a7083e4a593b03"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6260fc85ed1298a71d24a75d01f8b2e56d489a60"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6ebef4a220a1ebe345de899ebb9ae394206fe921"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7e8b270813079c785696bce8802a3f920665c88c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/89afe5e2dbea6e9d8e5f11324149d06fa3a4efca"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9feb2d1bf86d9e5e66b8565f37f8d3a7d281a772"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d073870dab8f6dadced81d13d273ff0b21cb7f4e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-31409 (GCVE-0-2026-31409)

Vulnerability from cvelistv5 – Published: 2026-04-06 07:38 – Updated: 2026-08-05 12:22

Title

ksmbd: unset conn->binding on failed binding request

Summary

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbd_session_lookup_all() calls fall back to the global sessions table. This fix it by clearing conn->binding = false in the error path.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6666 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/7e8b270813079c785…
https://git.kernel.org/stable/c/d073870dab8f6dadc…
https://git.kernel.org/stable/c/6ebef4a220a1ebe34…
https://git.kernel.org/stable/c/89afe5e2dbea6e9d8…
https://git.kernel.org/stable/c/9feb2d1bf86d9e5e6…
https://git.kernel.org/stable/c/6260fc85ed1298a71…
https://git.kernel.org/stable/c/282343cf8a4a5a360…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 7e8b270813079c785696bce8802a3f920665c88c (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < d073870dab8f6dadced81d13d273ff0b21cb7f4e (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 6ebef4a220a1ebe345de899ebb9ae394206fe921 (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 89afe5e2dbea6e9d8e5f11324149d06fa3a4efca (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 9feb2d1bf86d9e5e66b8565f37f8d3a7d281a772 (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 6260fc85ed1298a71d24a75d01f8b2e56d489a60 (git) Affected: f5a544e3bab78142207e0242d22442db85ba1eff , < 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 (git)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.78 , ≤ 6.12.* (semver) Unaffected: 6.18.20 , ≤ 6.18.* (semver) Unaffected: 6.19.10 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e8b270813079c785696bce8802a3f920665c88c",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "d073870dab8f6dadced81d13d273ff0b21cb7f4e",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "6ebef4a220a1ebe345de899ebb9ae394206fe921",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "89afe5e2dbea6e9d8e5f11324149d06fa3a4efca",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "9feb2d1bf86d9e5e66b8565f37f8d3a7d281a772",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "6260fc85ed1298a71d24a75d01f8b2e56d489a60",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            },
            {
              "lessThan": "282343cf8a4a5a3603b1cb0e17a7083e4a593b03",
              "status": "affected",
              "version": "f5a544e3bab78142207e0242d22442db85ba1eff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: unset conn-\u003ebinding on failed binding request\n\nWhen a multichannel SMB2_SESSION_SETUP request with\nSMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn-\u003ebinding = true\nbut never clears it on the error path. This leaves the connection in\na binding state where all subsequent ksmbd_session_lookup_all() calls\nfall back to the global sessions table. This fix it by clearing\nconn-\u003ebinding = false in the error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd processes SMB2 SESSION_SETUP and later SMB commands from remote peers over TCP/445 or SMB Direct. The vulnerable state is reachable through network SMB packets.\nAC:L - An attacker can deterministically create valid SMB3 sessions, send a malformed or failing binding SESSION_SETUP, and then issue further requests on the same connection. There is no race or condition outside the attacker\u0027s control beyond multichannel being enabled on the affected server.\nPR:L - The binding path requires an existing valid non-guest SMB session, which a basic authenticated SMB user can create. It does not require local system privileges or administrator/root access.\nUI:N - No victim action is needed after the server is running; exploitation is performed by sending SMB protocol messages. The attacker controls the network requests directly.\nS:U - The vulnerability breaks ksmbd\u0027s own session/channel authorization model but does not cross a separate security authority such as a VM, hypervisor, or sandbox boundary. The affected resources remain within the SMB server/kernel security scope.\nC:H - Leaving conn-\u003ebinding set lets subsequent session lookups fall back to the global session table, allowing a low-privileged SMB user to act through other valid sessions by session ID. This can expose arbitrary files and data accessible to hijacked SMB sessions.\nI:H - The same session confusion can allow creating tree connections and issuing file operations as another SMB user/session. That can modify or delete data with the victim session\u0027s privileges.\nA:H - The attacker can issue operations such as LOGOFF, tree disconnects, file closes, deletes, or repeated disruptive requests against other active sessions. This can cause complete availability loss for affected SMB sessions and their open files."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:18.697Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e8b270813079c785696bce8802a3f920665c88c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d073870dab8f6dadced81d13d273ff0b21cb7f4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ebef4a220a1ebe345de899ebb9ae394206fe921"
        },
        {
          "url": "https://git.kernel.org/stable/c/89afe5e2dbea6e9d8e5f11324149d06fa3a4efca"
        },
        {
          "url": "https://git.kernel.org/stable/c/9feb2d1bf86d9e5e66b8565f37f8d3a7d281a772"
        },
        {
          "url": "https://git.kernel.org/stable/c/6260fc85ed1298a71d24a75d01f8b2e56d489a60"
        },
        {
          "url": "https://git.kernel.org/stable/c/282343cf8a4a5a3603b1cb0e17a7083e4a593b03"
        }
      ],
      "title": "ksmbd: unset conn-\u003ebinding on failed binding request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31409",
    "datePublished": "2026-04-06T07:38:21.223Z",
    "dateReserved": "2026-03-09T15:48:24.087Z",
    "dateUpdated": "2026-08-05T12:22:18.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted