CVE-2026-31717

ksmbd: validate owner of durable handle on reconnect

High · published May 1, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate owner of durable handle on reconnect

Currently, ksmbd does not verify if the user attempting to reconnect

to a durable handle is the same user who originally opened the file.

This allows any authenticated user to hijack an orphaned durable handle

by predicting or brute-forcing the persistent ID.

According to MS-SMB2, the server MUST verify that the SecurityContext

of the reconnect request matches the SecurityContext associated with

the existing open.

Add a durable_owner structure to ksmbd_file to store the original opener's

UID, GID, and account name. and catpure the owner information when a file

handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner()

to validate the identity of the requester during SMB2_CREATE (DHnC).

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00601 · 48.1th percentile
Published
2026-05-01T13:56Z
EPSS history
Timeline
  • 01 MAY 13:56Z
    ksmbd: validate owner of durable handle on reconnect
    cvelistv5