Executive brief
A vulnerability exists in the Linux kernel's ksmbd component, which provides SMB file sharing services. When a specific type of connection request fails, the system incorrectly remains in a 'binding' state, which can disrupt how user sessions are managed. This could potentially allow an attacker to interfere with file sharing operations or access data they should not be able to reach.
Technical details
A vulnerability in the ksmbd component of the Linux kernel arises from improper state management during SMB2_SESSION_SETUP requests. Specifically, when a multichannel request with the SMB2_SESSION_REQ_FLAG_BINDING flag fails, the 'conn->binding' flag is set to true but is not cleared in the error path. This leaves the connection in a persistent binding state, causing subsequent 'ksmbd_session_lookup_all()' calls to incorrectly fall back to the global sessions table. An authenticated attacker could potentially exploit this logic error to bypass session isolation or cause a denial of service. Patches have been released for multiple stable kernel branches including 6.1, 6.6, 6.12, 6.18, and 6.19.
Affected products
- Linux Linux kernel 5.15 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-04-06: disclosed
- 2026-04-06: advisory
References
- https://git.kernel.org/stable/c/282343cf8a4a5a3603b1cb0e17a7083e4a593b03
- https://git.kernel.org/stable/c/6260fc85ed1298a71d24a75d01f8b2e56d489a60
- https://git.kernel.org/stable/c/6ebef4a220a1ebe345de899ebb9ae394206fe921
- https://git.kernel.org/stable/c/89afe5e2dbea6e9d8e5f11324149d06fa3a4efca
- https://git.kernel.org/stable/c/9feb2d1bf86d9e5e66b8565f37f8d3a7d281a772
- https://git.kernel.org/stable/c/d073870dab8f6dadced81d13d273ff0b21cb7f4e