PT-2026-36347 · Linux · Ksmbd

Published 2026-05-01 · Updated 2026-05-23 · CVE-2026-31717

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel ksmbd (affected versions not specified)

Description The ksmbd SMB server fails to verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows an authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID. To address this, the server must ensure the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open. The fix involves using a durable owner structure within ksmbd file to store the original opener's UID, GID, and account name, and implementing the ksmbd vfs compare durable owner() function to validate the requester's identity during SMB2 CREATE (DHnC).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31717

OPENSUSE-SU-2026:10793-1

Affected Products

Ksmbd

References · 50

• https://security-tracker.debian.org/tracker/CVE-2026-31717 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31717 · Vendor Advisory
• https://git.kernel.org/stable/c/c908c853f304a4969b5aa10eba0b50350cc65b80 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31717 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://git.kernel.org/stable/c/49110a8ce654bbe56bef7c5e44cce31f4b102b8a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31717 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31717 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31717 · Security Note
• https://git.kernel.org/stable/c/00ce8d6789dae72d042a4522264964c72891ca37 · Patch
• https://ubuntu.com/security/CVE-2026-31717 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-31715 · Note
• https://suse.com/security/cve/CVE-2026-31705 · Note
• https://suse.com/security/cve/CVE-2026-31710 · Note
• https://suse.com/security/cve/CVE-2026-31717 · Note