CVE-2026-31409 Linux CVE debrief

Who should care

Administrators and security teams running Linux kernels with ksmbd enabled, especially systems exposing SMB services over the network. Patch management teams should pay attention because the issue is network-reachable and NVD scores it as requiring only low privileges.

Technical summary

The kernel-side ksmbd server tracks a per-connection binding state during SMB2 multichannel session setup. The CVE description states that when a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails, ksmbd sets conn->binding = true but does not clear it on the failure path. That stale state causes subsequent ksmbd_session_lookup_all() calls to fall back to the global sessions table. The fix is to reset conn->binding = false when the binding request fails. NVD’s CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

High. The issue is network-exploitable, has low attack complexity, and can affect confidentiality, integrity, and availability according to NVD’s CVSS score. Systems running affected Linux kernel versions with ksmbd enabled should be prioritized for update.

Recommended defensive actions

• Update to a Linux kernel build that includes the upstream fix for ksmbd binding-state cleanup.
• Verify whether ksmbd is enabled and exposed on any production or edge systems.
• If immediate patching is not possible, reduce exposure of SMB services to trusted networks only.
• Validate vendor backports against the affected kernel ranges listed by NVD before concluding a system is fixed.
• Track kernel maintenance releases for the listed affected branches: 5.15, 6.2, 6.7, 6.13, 6.19, and 7.0 release candidates as applicable to your environment.

Evidence notes

Primary evidence comes from the CVE description and NVD record. The record says the flaw affects Linux kernel ksmbd multichannel session setup and that the fix clears conn->binding in the error path. NVD marks the CVE as analyzed and provides affected version criteria for Linux kernel branches ending before 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10, plus 7.0-rc1 through 7.0-rc4. Published date used here is 2026-04-06T08:16:38.943Z; modified date is 2026-05-20T16:15:51.630Z.

Official resources