High 8.8Published Apr 6, 2026

CVE-2026-31409ksmbd: unset conn->binding on failed binding request

Updated under an hour ago (Oct 26, 2026, 1:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset conn->binding on failed binding request When a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbd_session_lookup_all() calls fall back to the global sessions table. This fix it by clearing conn->binding = false in the error path.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f5a544e3bab78142207e0242d22442db85ba1eff before 7e8b270813079c785696bce8802a3f920665c88c; from f5a544e3bab78142207e0242d22442db85ba1eff before d073870dab8f6dadced81d13d273ff0b21cb7f4e; from f5a544e3bab78142207e0242d22442db85ba1eff before 6ebef4a220a1ebe345de899ebb9ae394206fe921; from f5a544e3bab78142207e0242d22442db85ba1eff before 89afe5e2dbea6e9d8e5f11324149d06fa3a4efca; from f5a544e3bab78142207e0242d22442db85ba1eff before 9feb2d1bf86d9e5e66b8565f37f8d3a7d281a772; from f5a544e3bab78142207e0242d22442db85ba1eff before 6260fc85ed1298a71d24a75d01f8b2e56d489a60; from f5a544e3bab78142207e0242d22442db85ba1eff before 282343cf8a4a5a3603b1cb0e17a7083e4a593b03	CNA record
linux linux_kernel linux:linux_kernel	from 5.15 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; 7.0; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/7e8b270813079c785696bce8802a3f920665c88c
https://git.kernel.org/stable/c/d073870dab8f6dadced81d13d273ff0b21cb7f4e	patch
https://git.kernel.org/stable/c/6ebef4a220a1ebe345de899ebb9ae394206fe921	patch
https://git.kernel.org/stable/c/89afe5e2dbea6e9d8e5f11324149d06fa3a4efca	patch
https://git.kernel.org/stable/c/9feb2d1bf86d9e5e66b8565f37f8d3a7d281a772	patch
https://git.kernel.org/stable/c/6260fc85ed1298a71d24a75d01f8b2e56d489a60	patch
https://git.kernel.org/stable/c/282343cf8a4a5a3603b1cb0e17a7083e4a593b03	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.