Exploitation Summary
EIP tracks 3 public exploits for CVE-2026-31717. PoCs published by TreasureBoy520, XZ1r0, TurtleARM.
AI-analyzed exploit summary This repository provides a functional proof-of-concept exploit for CVE-2026-31717, a durable handle reconnect access-control bypass in the Linux ksmbd kernel module. The exploit demonstrates how an authenticated SMB user can hijack another user's orphaned durable handle, bypassing POSIX ACLs by leveraging predictable persistent IDs and a missing authorization check in `smb2_check_durable_oplock()`.
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate owner of durable handle on reconnect Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcing the persistent ID. According to MS-SMB2, the server MUST verify that the SecurityContext of the reconnect request matches the SecurityContext associated with the existing open. Add a durable_owner structure to ksmbd_file to store the original opener's UID, GID, and account name. and catpure the owner information when a file handle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner() to validate the identity of the requester during SMB2_CREATE (DHnC).
Exploits (3)
This repository provides a functional proof-of-concept exploit for CVE-2026-31717, a durable handle reconnect access-control bypass in the Linux ksmbd kernel module. The exploit demonstrates how an authenticated SMB user can hijack another user's orphaned durable handle, bypassing POSIX ACLs by leveraging predictable persistent IDs and a missing authorization check in `smb2_check_durable_oplock()`.
This repository contains a functional exploit for CVE-2026-31717, which targets a durable-handle reconnect access-control bypass in the Linux ksmbd SMB server. The exploit includes a setup script to build a vulnerable QEMU environment and a Python script to demonstrate the ACL bypass by hijacking orphaned durable handles.
This repository contains a functional exploit for CVE-2026-31717, which allows an authenticated SMB user to hijack another user's orphaned durable handle in the Linux ksmbd server, bypassing POSIX ACL checks. The exploit demonstrates the vulnerability by showing how an attacker can read and write to a file owned by another user with restrictive permissions.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H