https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:15:39 +0000 https://vulnerability.circl.lu/vuln/cve-2026-31476 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: do not expire session on binding failure</p> <p>When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess-&gt;state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() -- which belongs to another connection&#39;s user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS).</p> <p>Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: do not expire session on binding failure</p> <p>When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess-&gt;state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() -- which belongs to another connection&#39;s user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS).</p> <p>Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put().</p> https://vulnerability.circl.lu/vuln/cve-2026-31476