A flaw in the Linux kernel’s SMB client caused the kernel to reuse an established Kerberos authenticated session when mounting a new share that specified a different username. Because the authentication logic ignored the username mount option, the client attempted to authenticate the second share using credentials from the first mount, either failing or granting access to a share that should be protected by another Kerberos principal. The result is a potential authentication bypass that lets a user or attacker access shares with the wrong Kerberos credentials.

Linux systems that use the CIFS/SMB client with Kerberos authentication (sec=krb5) and a keytab file are impacted. The bug exists in the cifs client implementation of the Linux kernel; any kernel version that has not incorporated the upstream patch is vulnerable.

The vulnerability does not require advanced privileges; an attacker only needs the ability to perform SMB mounts with different usernames. Once a session is established with one Kerberos principal, subsequent mounts using a different username will reuse the same session, potentially exposing data. No EPSS score or KEV listing is available, but the bug was addressed in a kernel commit and is considered mitigated by applying the updated kernel. The risk is moderate to high for environments that mount multiple SMB shares with Kerberos, especially when shares are intended to be isolated by principal.