CVE-2026-31392

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix krb5 mount with username option

Customer reported that some of their krb5 mounts were failing against

a single server as the client was trying to mount the shares with

wrong credentials. It turned out the client was reusing SMB session

from first mount to try mounting the other shares, even though a

different username= option had been specified to the other mounts.

By using username mount option along with sec=krb5 to search for

principals from keytab is supported by cifs.upcall(8) since

cifs-utils-4.8. So fix this by matching username mount option in

match_session() even with Kerberos.

For example, the second mount below should fail with -ENOKEY as there

is no 'foobar' principal in keytab (/etc/krb5.keytab). The client

ends up reusing SMB session from first mount to perform the second

one, which is wrong.

```

$ ktutil

ktutil: add_entry -password -p testuser -k 1 -e aes256-cts

Password for tes

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References