Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U N N H 5.5 .0014 3.5 —
AFFECTED
Product Versions Fixed
Linux fad4161b5cd01a24202234976ebbb133f7adc0b5 – —
Linux 5.15 – 5.15.212
TIMELINE
Mar 9 Reserved by Linux
Apr 24 Published (CNA: Linux)
Jul 24 ENRICHED — CVE-2026-31610 (Linux). Received CVSS 5.5 and CPE data from NVD.
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
The kernel ASN.1 BER decoder calls action callbacks incrementally as it
walks the input. When ksmbd_decode_negTokenInit() reaches the mechToken
[2] OCTET STRING element, ksmbd_neg_token_alloc() allocates
conn->mechToken immediately via kmemdup_nul(). If a later element in
the same blob is malformed, then the decoder will return nonzero after
the allocation is already live. This could happen if mechListMIC [3]
overrunse the enclosing SEQUENCE.
decode_negotiation_token() then sets conn->use_spnego = false because
both the negTokenInit and negTokenTarg grammars failed. The cleanup at
the bottom of smb2_sess_setup() is gated on use_spnego:
if (conn->use_spnego && conn->mechToken) {
kfree(conn->mechToken);
conn->mechToken = NULL;
}
so the kfree is skipped, causing the mechToken to never be freed.
This codepath is reachable pre-authentication, so untrusted clients can
cause slow memory leaks on a server without even being properly
authenticated.
Fix this up by not checking check for use_spnego, as it's not required,
so the memory will always be properly freed. At the same time, always
free the memory in ksmbd_conn_free() incase some other failure path
forgot to free it.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| March 9, 2026 | Reserved | Reserved by Linux |
| April 24, 2026 | Published | Published (CNA: Linux) |
| July 24, 2026 | ENRICHED | ENRICHED — CVE-2026-31610 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | fad4161b5cd01a24202234976ebbb133f7adc0b5 | — |
| Linux | Linux | — | 5.15 | 5.15.212 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-31610 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.