In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate owner of durable handle on reconnect
Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID.
According to MS-SMB2, the server MUST verify that the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open. Add a durable_owner structure to ksmbd_file to store the original opener's UID, GID, and account name. and catpure the owner information when a file handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner() to validate the identity of the requester during SMB2_CREATE (DHnC).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-aws-7.0Upgrade linux-image-7.0.0-1008-aws-64kUpgrade linux-image-aws-64k-7.0Upgrade linux-image-raspi-realtime-7.0Upgrade linux-image-7.0.0-1008-awsUpgrade linux-image-7.0.0-27-generic-64kUpgrade linux-image-azure-fde-7.0Upgrade linux-image-7.0.0-1007-gcpUpgrade linux-image-gcp-7.0Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-nvidiaUpgrade linux-image-oem-24.04bUpgrade linux-image-genericUpgrade linux-image-7.0.0-1007-gcp-64kUpgrade linux-image-nvidia-7.0Upgrade linux-image-ibm-7.0Upgrade linux-image-7.0.0-1014-raspi-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-oem-24.04Upgrade linux-image-oracleUpgrade linux-image-realtime-64k-7.0Upgrade linux-image-7.0.0-28-genericUpgrade linux-image-7.0.0-1009-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-1010-azureUpgrade linux-image-7.0.0-1013-nvidia-64kUpgrade linux-image-7.0.0-27-realtime-64kUpgrade linux-image-azureUpgrade linux-image-generic-64kUpgrade linux-image-raspiUpgrade linux-image-realtime-7.0Upgrade linux-image-7.0.0-27-realtimeUpgrade linux-image-7.0.0-28-generic-64kUpgrade linux-image-realtimeUpgrade linux-image-azure-7.0Upgrade linux-image-oem-24.04dUpgrade linux-image-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-7.0.0-1013-nvidiaUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-generic-hwe-26.04Upgrade linux-image-generic-7.0Upgrade linux-image-7.0.0-27-genericUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-raspi-7.0Upgrade linux-image-virtual-7.0Upgrade linux-image-raspi-realtimeUpgrade linux-image-oem-24.04cUpgrade linux-image-awsUpgrade linux-image-realtime-hwe-26.04Upgrade linux-image-gcpUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-azure-fdeUpgrade linux-image-7.0.0-1014-raspiUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-realtime-64kUpgrade linux-image-oracle-7.0Upgrade linux-image-aws-64kUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-7.0.0-1007-oracleUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-7.0.0-1007-oracle-64kUpgrade linux-image-generic-64k-7.0 | Jul 1, 2026 | May 1, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 10, 2026 | May 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub