CVE-2026-31409

kernel: ksmbd: unset conn->binding on failed binding request

Loading…

Severity

Low

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · April 6, 2026

Updated · October 20, 2026

Description

A flaw was found in ksmbd, a component of the Linux kernel. This vulnerability occurs when a multichannel Server Message Block (SMB2) session setup request, specifically one with a binding flag, fails. Due to an error in handling this failure, ksmbd incorrectly retains a binding state for the connection. This can lead to all subsequent session lookups falling back to a global sessions table, potentially causing unexpected session management and service disruption.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-390 · Detection of Error Condition Without Action