Improper Authentication in Linux Kernel ksmbd for Durable Handle Reconnection

CVE-2026-31717

What is CVE-2026-31717?

A significant vulnerability exists in the Linux Kernel's ksmbd that fails to appropriately validate the user attempting to reconnect to a durable handle. This oversight permits any authenticated user to potentially hijack an orphaned durable handle simply by predicting or brute-forcing the persistent ID. The SMB2 protocol mandates that the server verifies the SecurityContext of the reconnect request against the original user's SecurityContext. The absence of this validation compromises the security integrity of file handling, necessitating the implementation of a durable_owner structure within ksmbd_file to store the original owner’s UID, GID, and account name. This recent patch addresses the critical requirement for accurate user identity verification during the SMB2_CREATE operation.

References