CVE-2026-31610 - Vulnerability Details

- ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc

The kernel ASN.1 BER decoder calls action callbacks incrementally as it
walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken
[2] OCTET STRING element, ksmbd_neg_token_alloc() allocates
conn->mechToken immediately via kmemdup_nul(). If a later element in
the same blob is malformed, then the decoder will return nonzero after
the allocation is already live. This could happen if mechListMIC [3]
overrunse the enclosing SEQUENCE.

decode_negotiation_token() then sets conn->use_spnego = false because
both the negTokenInit and negTokenTarg grammars failed. The cleanup at
the bottom of smb2_sess_setup() is gated on use_spnego:

if (conn->use_spnego && conn->mechToken) {
kfree(conn->mechToken);
conn->mechToken = NULL;
}

so the kfree is skipped, causing the mechToken to never be freed.

This codepath is reachable pre-authentication, so untrusted clients can
cause slow memory leaks on a server without even being properly
authenticated.

Fix this up by not checking check for use_spnego, as it's not required,
so the memory will always be properly freed. At the same time, always
free the memory in ksmbd_conn_free() incase some other failure path
forgot to free it.

Published: 2026-04-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This kernel vulnerability allows an untrusted client to trigger a memory leak in the ksmbd SMB server when SPNEGO negotiation fails after a mechToken allocation. The leak occurs because the allocated mechToken is not freed if the decoder encounters a malformed subsequent element. As the code path is reachable before authentication, an attacker can repeatedly send crafted requests to increase kernel memory usage, potentially exhausting system resources and leading to denial of service.

Affected Systems

Any system running a Linux kernel version that includes the ksmbd SMB3 implementation prior to the fix. The exact versions impacted are not listed, but the vulnerability was addressed in a kernel patch that modifies the SPNEGO handling routines.

Risk and Exploitability

The risk is a denial‑of‑service that can degrade server availability over time. The CVSS v3.1 base score is 5.5, indicating medium severity. The EPSS score is less than 1 %, indicating a very low probability of current exploitation, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending malformed SPNEGO negotiation packets to a ksmbd service before authentication, causing repeated allocations that are never freed.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fad4161b5cd01a24202234976ebbb133f7adc0b5`	affected	< 745a535461bbb90a56d9357573c9f97a5c12abe1
`fad4161b5cd01a24202234976ebbb133f7adc0b5`	affected	< dd577cb55588ec3fbc66af3621280306601c4192
`fad4161b5cd01a24202234976ebbb133f7adc0b5`	affected	< dd53414e301beb915fe672dc4c4a51bafb917604
`fad4161b5cd01a24202234976ebbb133f7adc0b5`	affected	< 269c800a7a7e363459291885b35f7bc72e231ed6
`fad4161b5cd01a24202234976ebbb133f7adc0b5`	affected	< 6c8c44e6553b9f072f62d9875e567766eb293162
`fad4161b5cd01a24202234976ebbb133f7adc0b5`	affected	< ad0057fb91218914d6c98268718ceb9d59b388e1

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.6.136`	unaffected	≤ 6.6.*
`6.12.83`	unaffected	≤ 6.12.*
`6.18.24`	unaffected	≤ 6.18.*
`6.19.14`	unaffected	≤ 6.19.*
`7.0.1`	unaffected	≤ 7.0.*
`7.1-rc1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[fad4161b5cd01a24202234976ebbb133f7adc0b5,745a535461bbb90a56d9357573c9f97a5c12abe1)`	affected	code_commit	—
`[fad4161b5cd01a24202234976ebbb133f7adc0b5,dd577cb55588ec3fbc66af3621280306601c4192)`	affected	code_commit	—
`[fad4161b5cd01a24202234976ebbb133f7adc0b5,dd53414e301beb915fe672dc4c4a51bafb917604)`	affected	code_commit	—
`[fad4161b5cd01a24202234976ebbb133f7adc0b5,269c800a7a7e363459291885b35f7bc72e231ed6)`	affected	code_commit	—
`[fad4161b5cd01a24202234976ebbb133f7adc0b5,6c8c44e6553b9f072f62d9875e567766eb293162)`	affected	code_commit	—
`[fad4161b5cd01a24202234976ebbb133f7adc0b5,ad0057fb91218914d6c98268718ceb9d59b388e1)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[6.6.136,6.7.0)`	unaffected	semver	—
`[6.12.83,6.13.0)`	unaffected	semver	—
`[6.18.24,6.19.0)`	unaffected	semver	—
`[6.19.14,6.20.0)`	unaffected	semver	—
`[7.0.1,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that fixes the ksmbd mechToken leak, which removes the conditional for use_spnego and ensures allocation is always freed.
If the updated kernel cannot be applied immediately, disable ksmbd or SASL/SMB services that accept SPNEGO negotiation to eliminate the attack surface.
Configure system resource limits or run a containerized sandbox for SMB services to contain any unintended memory growth and monitor for abnormal memory usage.

Generated by OpenCVE AI on April 29, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6238-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00023.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/269c800a7a7e363459291885b35f7bc72e231ed6
https://git.kernel.org/stable/c/6c8c44e6553b9f072f62d9875e567766eb293162
https://git.kernel.org/stable/c/745a535461bbb90a56d9357573c9f97a5c12abe1
https://git.kernel.org/stable/c/ad0057fb91218914d6c98268718ceb9d59b388e1
https://git.kernel.org/stable/c/dd53414e301beb915fe672dc4c4a51bafb917604
https://git.kernel.org/stable/c/dd577cb55588ec3fbc66af3621280306601c4192
https://lore.kernel.org/linux-cve-announce/2026042421-CVE-2026-31610-40ea@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31610
https://www.cve.org/CVERecord?id=CVE-2026-31610

History

Wed, 29 Apr 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/745a535461bbb90a56d9357573c9f97a5c12abe1

Mon, 27 Apr 2026 11:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/ad0057fb91218914d6c98268718ceb9d59b388e1

Sat, 25 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026042421-CVE-2026-31610-40ea@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31610 https://www.cve.org/CVERecord?id=CVE-2026-31610

Fri, 24 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken [2] OCTET STRING element, ksmbd_neg_token_alloc() allocates conn->mechToken immediately via kmemdup_nul(). If a later element in the same blob is malformed, then the decoder will return nonzero after the allocation is already live. This could happen if mechListMIC [3] overrunse the enclosing SEQUENCE. decode_negotiation_token() then sets conn->use_spnego = false because both the negTokenInit and negTokenTarg grammars failed. The cleanup at the bottom of smb2_sess_setup() is gated on use_spnego: if (conn->use_spnego && conn->mechToken) { kfree(conn->mechToken); conn->mechToken = NULL; } so the kfree is skipped, causing the mechToken to never be freed. This codepath is reachable pre-authentication, so untrusted clients can cause slow memory leaks on a server without even being properly authenticated. Fix this up by not checking check for use_spnego, as it's not required, so the memory will always be properly freed. At the same time, always free the memory in ksmbd_conn_free() incase some other failure path forgot to free it.
Title		ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/269c800a7a7e363459291885b35f7bc72e231ed6 https://git.kernel.org/stable/c/6c8c44e6553b9f072f62d9875e567766eb293162 https://git.kernel.org/stable/c/dd53414e301beb915fe672dc4c4a51bafb917604 https://git.kernel.org/stable/c/dd577cb55588ec3fbc66af3621280306601c4192

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-24T14:42:31.471Z

Updated: 2026-05-11T22:12:08.314Z

Reserved: 2026-03-09T15:48:24.122Z

Link: CVE-2026-31610

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-24T15:16:40.257

Modified: 2026-04-29T16:51:02.850

Link: CVE-2026-31610

Redhat

Severity :

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31610 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-29T21:45:20Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object