SB20260502135 - Improper access control in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-31717)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a remote user to hijack an orphaned durable handle.

The vulnerability exists due to improper access control in durable handle reconnect validation in ksmbd when processing SMB2 durable handle reconnect requests. A remote user can predict or brute-force the persistent ID and reconnect to the orphaned handle to hijack an orphaned durable handle.

The issue occurs because the reconnecting user's security context is not verified against the original opener's identity.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/00ce8d6789dae72d042a4522264964c72891ca37
• https://git.kernel.org/stable/c/49110a8ce654bbe56bef7c5e44cce31f4b102b8a
• https://git.kernel.org/stable/c/c908c853f304a4969b5aa10eba0b50350cc65b80