SMB2_SESSION_SETUP Vulnerability in Linux Kernel Affects Multiple Distributions

CVE-2026-31409

What is CVE-2026-31409?

This vulnerability in the Linux kernel’s ksmbd component impacts the handling of multichannel SMB2_SESSION_SETUP requests. When a binding request fails, the connection erroneously retains a binding state, which can lead to improper fallbacks to the global session table during subsequent lookups. This behavior could potentially disrupt the stability and reliability of SMB connections. The fix involves correctly resetting the conn->binding state upon a binding request failure, ensuring that subsequent session operations function as intended.

References