Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-31392— smb: client: fix krb5 mount with username option

CVSS 8.1 · High EPSS 0.12% · P2

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinux4ff67b720c02c36e54d55b88c2931879b7db1cd2< fd4547830720647d4af02ee50f883c4b1cca06e4affected
4ff67b720c02c36e54d55b88c2931879b7db1cd2< 9229709ec8bf85ae7ca53aeee9aa14814cdc1bd2affected
4ff67b720c02c36e54d55b88c2931879b7db1cd2< d33cbf0bf8979d779900da9be2505d68d9d8da25affected
4ff67b720c02c36e54d55b88c2931879b7db1cd2< 9ee803bfdba0cf739038dbdabdd4c02582c8f2b2affected
4ff67b720c02c36e54d55b88c2931879b7db1cd2< 6e9ff1eb7feedcf46ff2d0503759960ab58e7775affected
4ff67b720c02c36e54d55b88c2931879b7db1cd2< 12b4c5d98cd7ca46d5035a57bcd995df614c14e1affected
223c7f082d2836ac719b3b228bdcfab35e5e5330affected
88720224330a655ab6268e20109b65b11cfd7f6aaffected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-31392

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
smb: client: fix krb5 mount with username option
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single server as the client was trying to mount the shares with wrong credentials. It turned out the client was reusing SMB session from first mount to try mounting the other shares, even though a different username= option had been specified to the other mounts. By using username mount option along with sec=krb5 to search for principals from keytab is supported by cifs.upcall(8) since cifs-utils-4.8. So fix this by matching username mount option in match_session() even with Kerberos. For example, the second mount below should fail with -ENOKEY as there is no 'foobar' principal in keytab (/etc/krb5.keytab). The client ends up reusing SMB session from first mount to perform the second one, which is wrong. ``` $ ktutil ktutil: add_entry -password -p testuser -k 1 -e aes256-cts Password for testuser@ZELDA.TEST: ktutil: write_kt /etc/krb5.keytab ktutil: quit $ klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------------------------------------------------------- 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96) $ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser $ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar $ mount -t cifs | grep -Po 'username=\K\w+' testuser testuser ```
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于匹配会话时未验证用户名，可能导致使用错误凭据挂载共享。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 4ff67b720c02c36e54d55b88c2931879b7db1cd2 ~ fd4547830720647d4af02ee50f883c4b1cca06e4 -
LinuxLinux 2.6.36 -

II. Public POCs for CVE-2026-31392

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31392

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-03 · 71 CVEs total

CVE-2026-314029.8 CRITICALnfsd: fix heap overflow in NFSv4.0 LOCK replay cache
CVE-2026-234509.8 CRITICALnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
CVE-2026-234279.8 CRITICALksmbd: fix use-after-free in durable v2 replay of active file handles
CVE-2026-234289.8 CRITICALksmbd: fix use-after-free of share_conf in compound request
CVE-2026-234559.1 CRITICALnetfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
CVE-2026-234258.8 HIGHKVM: arm64: Fix ID register initialization for non-protected pKVM guests
CVE-2026-234618.8 HIGHBluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
CVE-2026-234628.8 HIGHBluetooth: HIDP: Fix possible UAF
CVE-2026-234578.6 HIGHnetfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
CVE-2026-234598.2 HIGHip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
CVE-2026-234568.2 HIGHnetfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
CVE-2026-313938.1 HIGHBluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
CVE-2026-313967.8 HIGHnet: macb: fix use-after-free access to PTP clock
CVE-2026-234327.8 HIGHmshv: Fix use-after-free in mshv_map_user_memory error path
CVE-2026-314017.8 HIGHHID: bpf: prevent buffer overflow in hid_hw_request
CVE-2026-234587.8 HIGHnetfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
CVE-2026-234377.8 HIGHnet: shaper: protect late read accesses to the hierarchy
CVE-2026-234447.8 HIGHwifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
CVE-2026-234497.8 HIGHnet/sched: teql: Fix double-free in teql_master_xmit
CVE-2026-234457.8 HIGHigc: fix page fault in XDP TX timestamps handling

Showing top 20 of 71 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31392

No comments yet

Leave a comment