CVE-2026-31476

kernel: ksmbd: do not expire session on binding failure

Loading…

Severity

Important

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · April 22, 2026

Updated · October 20, 2026

Description

A flaw was found in ksmbd in the Linux kernel. A remote attacker can exploit this vulnerability by sending a multichannel session binding request with an incorrect password. This improper handling of failed binding requests can cause an active session to expire, leading to a Denial of Service (DoS) for legitimate users.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-639 · Authorization Bypass Through User-Controlled Key