CVE-2026-31717
- Source
- https://cve.org/CVERecord?id=CVE-2026-31717
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31717.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-31717
- Downstream
- Related
- Published
- 2026-05-01T13:56:12.012Z
- Modified
- 2026-07-15T01:48:56.309605789Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- ksmbd: validate owner of durable handle on reconnect
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate owner of durable handle on reconnect
Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID.
According to MS-SMB2, the server MUST verify that the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open. Add a durableowner structure to ksmbdfile to store the original opener's UID, GID, and account name. and catpure the owner information when a file handle becomes orphaned. and implementing ksmbdvfscomparedurableowner() to validate the identity of the requester during SMB2_CREATE (DHnC).
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31717.json" }- References
-
- https://git.kernel.org/stable/c/00ce8d6789dae72d042a4522264964c72891ca37
- https://git.kernel.org/stable/c/49110a8ce654bbe56bef7c5e44cce31f4b102b8a
- https://git.kernel.org/stable/c/712cdf917e77a6444ce3836874829d770db20ee6
- https://git.kernel.org/stable/c/c7f0f0d01c88bdcb8b1694d7d321670013f7ed7d
- https://git.kernel.org/stable/c/c908c853f304a4969b5aa10eba0b50350cc65b80
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31717.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-31717
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8df4bcdb0a4232192b2445256c39b787d58ef14dFixed712cdf917e77a6444ce3836874829d770db20ee6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc8efcc786146a951091588e5fa7e3c754850cb3cFixedc7f0f0d01c88bdcb8b1694d7d321670013f7ed7dFixed00ce8d6789dae72d042a4522264964c72891ca37Fixedc908c853f304a4969b5aa10eba0b50350cc65b80Fixed49110a8ce654bbe56bef7c5e44cce31f4b102b8a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.32Fixed6.6.142
Affected versions
v6.*
Linux / Kernel
Package
- Name
- Kernel