CVE-2026-31476

What it actually does

CVE-2026-31476 is a network-reachable denial-of-service flaw in the Linux kernel ksmbd SMB server. During SMB multichannel session binding, a failed binding attempt, such as one using an incorrect password, can incorrectly mark an existing session from another connection as expired. Because the session object is looked up from the target session rather than belonging to the current failed connection, an unauthenticated remote attacker can invalidate active SMB sessions and disrupt access to file shares. The primary impact is high availability loss, with limited integrity impact because the attacker can improperly modify session state, but there is no direct confidentiality impact described.

Why it matters to the business

Organizations using the in-kernel Linux SMB server can experience forced disconnects, failed file-share access, interrupted file transfers, application errors, backup failures, or user productivity disruption. The CVSS score is high at 8.2 because exploitation is remote, low-complexity, requires no prior authentication, and can significantly affect availability. EPSS is currently low and stable, the vulnerability is not listed in CISA KEV, and no public exploit maturity is reported, but internet- or broadly network-exposed SMB services should still be prioritized because SMB outages can affect shared storage, operational workflows, and dependent applications.

How an attack unfolds

An attacker first identifies a Linux system exposing ksmbd over SMB, typically on TCP port 445. The attacker then sends SMB2 session setup traffic designed as a multichannel session binding request that references an active target session. The binding attempt intentionally fails, for example by supplying an incorrect password. In vulnerable kernels, the failure path treats the looked-up target session as expired even though it belongs to another connection. As a result, legitimate clients using that session can be disconnected or forced to reauthenticate, and repeated attempts can cause recurring denial of service against active SMB users. No named threat actors or ransomware campaigns are currently associated with this vulnerability in the provided intelligence.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the ksmbd fix for the session-binding failure path, specifically the change described as preventing session expiration on binding failure. No exact fixed package versions were provided, so use vendor advisories, kernel changelogs, or distribution security trackers to identify the first fixed kernel for each supported platform. If immediate patching is not possible, disable ksmbd where it is not required, migrate temporarily to a patched userspace SMB implementation if appropriate, restrict SMB access to trusted networks and clients, block external access to TCP/445, and monitor for repeated failed SMB session binding or authentication events. Standard authentication hardening helps reduce noise but does not fully mitigate this issue because exploitation does not require valid credentials.

How to confirm the fix worked

Confirm that affected systems are no longer running a vulnerable kernel build and that the installed kernel changelog or source includes the ksmbd fix that skips expiring a session when the failed request was a binding attempt. Verify whether ksmbd is enabled by checking kernel modules, ksmbd service state, SMB listeners on TCP/445, and ksmbd configuration. From a controlled test network, validate that failed multichannel binding attempts do not terminate unrelated active SMB sessions. Also confirm compensating controls by verifying that SMB is not reachable from untrusted networks and that firewall rules limit TCP/445 exposure to authorized clients only.

Typical attack path

1. Find a Linux host exposing the kernel ksmbd SMB service, commonly reachable on TCP/445.
2. Establish SMB negotiation and craft an SMB2 session binding attempt for a target session.
3. Submit invalid credentials or otherwise force the binding request to fail.
4. Trigger the vulnerable error path that marks the looked-up session as expired.
5. Cause legitimate SMB clients to lose active sessions, fail file operations, or reconnect repeatedly.
6. Repeat the process to sustain disruption of SMB file-share availability.

How to detect it

Look for evidence of repeated failed SMB2 session setup or multichannel binding attempts against ksmbd, especially when followed by session expiration, client disconnects, reconnect storms, failed file operations, or user reports of interrupted share access. Useful log sources include kernel logs, systemd journal, ksmbd service logs, authentication logs, firewall or NetFlow records for TCP/445, IDS/IPS SMB protocol telemetry, and endpoint telemetry showing ksmbd activity. Hunt for spikes in SMB authentication failures from a small number of source IPs, many failed session setup attempts referencing active services, or repeated disconnects affecting multiple legitimate clients at the same time. Because exploitation causes denial of service rather than code execution, there may be no malware artifact; correlation between failed SMB binding/authentication activity and session expiry or client disconnect events is the strongest signal. Network captures or IDS metadata showing repeated SMB2 SESSION_SETUP traffic with binding behavior and failed authentication from untrusted or unusual sources can support confirmation.

• ksmbd
• ksmbd.mountd
• SMB2_SESSION_SETUP
• SMB2_SESSION_EXPIRED
• STATUS_NETWORK_SESSION_EXPIRED
• STATUS_USER_SESSION_DELETED
• STATUS_LOGON_FAILURE
• NT_STATUS_LOGON_FAILURE
• session expired
• session setup failed
• authentication failed
• TCP/445

What your security team should do

• Inventory Linux systems and appliances running the in-kernel ksmbd SMB server, prioritizing systems exposing TCP/445 to broad internal networks or the internet.
• Patch affected kernels using vendor-provided security updates as the preferred remediation.
• Where patching is delayed, disable ksmbd or restrict SMB access to trusted client networks only.
• Review firewall, VPN, and segmentation rules to ensure SMB is not exposed beyond operationally required sources.
• Monitor ksmbd and authentication logs for bursts of failed SMB session setup or binding attempts followed by legitimate client disconnects.
• Coordinate with storage, backup, and application owners because exploitation may appear as intermittent file-share instability rather than a conventional intrusion.
• Track vendor advisories for exact fixed kernel/package versions, since fixed versions were not provided in the input.
• Treat repeated unexplained ksmbd session expirations as potentially malicious even though EPSS is currently low, exploit maturity is reported as none, and the issue is not in KEV.