HIGH
ksmbd DurableHandle Hijack
CVE-2026-31717
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate owner of durable handle on reconnect Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID. According to MS-SMB2, the server MUST verify that the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open. Add a durable_owner structure to ksmbd_file to store the original opener's UID, GID, and account name. and catpure the owner information when a file handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner() to validate the identity of the requester during SMB2_CREATE (DHnC).
02KernelScan AI Analysis
Risk summary
Any authenticated SMB user can hijack orphaned durable file handles from other users by predicting or brute-forcing persistent IDs. This allows unauthorized access to files opened by other users, potentially exposing sensitive data or enabling privilege escalation within the SMB share.
Vulnerability analysis
The root cause is missing owner validation during durable handle reconnection in ksmbd's SMB2 implementation. When a client reconnects to a durable handle after a network interruption, ksmbd only validates the persistent ID but not the user's SecurityContext against the original opener. The fix adds a durable_owner structure to store the original opener's UID, GID, and account name, then implements ksmbd_vfs_compare_durable_owner() to validate identity during SMB2_CREATE reconnection requests. This vulnerability is network-reachable through SMB protocol and requires only low privileges (any authenticated SMB user).
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.92 | c7f0f0d01c88 |
| 6.18 | 6.18.25 | 00ce8d6789da |
| 6.6 | 6.6.142 | 712cdf917e77 |
| 7.0 | 7.0.2 | c908c853f304 |
| mainline | 7.1-rc1 | 49110a8ce654 |