Executive brief
A vulnerability in the Linux kernel's SMB client could allow a user to access network file shares using the wrong credentials. When mounting multiple shares from the same server using Kerberos authentication, the system incorrectly reuses an existing session even if a different username was specified for the new mount. This could lead to unauthorized access to sensitive data or the ability to modify files on a network share using another user's identity.
Technical details
A session reuse vulnerability exists in the Linux kernel SMB client (cifs.ko) when using Kerberos authentication (sec=krb5). The 'match_session' function in 'fs/smb/client/connect.c' failed to validate the 'username' mount option when searching for an existing SMB session to reuse. Consequently, if a user attempts to mount a second share from the same server with a different username, the kernel may reuse the existing session established by the first user. This bypasses intended credential isolation and can result in a user operating with the privileges of a different principal found in the system keytab. The fix involves adding a string comparison of the username in 'match_session' for Kerberos-authenticated sessions.
Affected products
- Linux Linux Kernel 4ff67b720c02c36e54d55b88c2931879b7db1cd2 to fd4547830720647d4af02ee50f883c4b1cca06e4
Timeline
- 2026-03-13: other: Patch authored
- 2026-04-03: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/12b4c5d98cd7ca46d5035a57bcd995df614c14e1
- https://git.kernel.org/stable/c/6e9ff1eb7feedcf46ff2d0503759960ab58e7775
- https://git.kernel.org/stable/c/9229709ec8bf85ae7ca53aeee9aa14814cdc1bd2
- https://git.kernel.org/stable/c/9ee803bfdba0cf739038dbdabdd4c02582c8f2b2
- https://git.kernel.org/stable/c/d33cbf0bf8979d779900da9be2505d68d9d8da25
- https://git.kernel.org/stable/c/fd4547830720647d4af02ee50f883c4b1cca06e4