Linux kernel ksmbd CVE-2026-31432

Upgrade Linux kernel to patched versions: 6.12.81, 6.18.22, 6.19.12, or 7.0 or later, depending on your kernel branch. Patches are available from the kernel stable trees at https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09, https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45, https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617, and https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc. If immediate patching is not feasible, implement compensating controls: disable ksmbd module entirely if not required (unload ksmbd.ko, blacklist in modprobe.d) and use Samba for SMB file sharing instead, which eliminates exposure with no functional loss for most deployments. Alternatively, restrict SMB access to ksmbd services using firewall rules (block ports 445/139) to trusted networks only, though this does not prevent exploitation by authenticated attackers within the trust boundary. If ksmbd must remain enabled pre-patch, audit and minimize user privileges for SMB accounts, implement strict network segmentation, and enable kernel exploit mitigations (KASLR, SMEP, SMAP) if not already active. Note that disabling ksmbd requires service restart and may interrupt active SMB sessions; restricting network access may impact legitimate remote file access workflows.