Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) can allow an unauthenticated attacker to cause a permanent denial-of-service condition. By repeatedly triggering specific connection failures, an attacker can exhaust the server's connection pool, eventually causing the server to reject all new legitimate connection attempts. This state persists until the system is rebooted or the affected kernel module is reloaded, disrupting file-sharing services for all users.
Technical details
A resource leak exists in the ksmbd_tcp_new_connection() function within the Linux kernel's SMB server implementation. The ksmbd_kthread_fn() function increments the 'active_num_conn' counter before calling ksmbd_tcp_new_connection(); however, if alloc_transport() fails (returning NULL), the counter is not decremented. An unauthenticated remote attacker can trigger this failure path by inducing memory pressure, for example, by holding open multiple connections with large RFC1002 lengths. Each failure permanently consumes a slot in the 'max_connections' pool. Once the limit is reached, all subsequent connection attempts are rejected. The issue has been patched across multiple stable kernel branches by ensuring the counter is decremented upon transport allocation failure.
Affected products
- Linux Linux Kernel 5.15.91 to 5.16, 6.1.9 to 6.2, 6.2.1 to 6.6.136, 6.7 to 6.12.84, 6.13 to 6.18.25, 6.19 to 7.0.2
Timeline
- 2026-04-14: other: Vulnerability fixed in kernel source
- 2026-05-01: advisory: CVE-2026-31711 published
References
- https://git.kernel.org/stable/c/283027aa93380380a0994f35dde3ec95318f2654
- https://git.kernel.org/stable/c/295a9fc6789d1011c36ded9f0f2907bb34fa0de4
- https://git.kernel.org/stable/c/60734c8bc3b4aa0672e251f08dda81977e4b5387
- https://git.kernel.org/stable/c/6551300dc452ac16a855a83dbd1e74899542d3b3
- https://git.kernel.org/stable/c/97f8d2648ef4871e4cd335e2d769cb40054a6772
- https://git.kernel.org/stable/c/fb48185bcd946d42de7017cf27f912f8ab26acf0