Linux ksmbd CVE-2026-31717

Primary remediation is upgrading to patched kernel versions: 6.18.25, 7.0.2, or 7.1-rc1 and later from the stable kernel tree. Enterprise Linux users should apply distribution-specific updates when available through their vendor's security update channels (e.g., Red Hat RHSA, Ubuntu USN, SUSE SUSE-SU advisories). Organizations unable to immediately patch can implement these compensating controls: (1) Disable ksmbd module entirely if not required (rmmod ksmbd and blacklist in /etc/modprobe.d/), noting this eliminates all in-kernel SMB server functionality; (2) Restrict SMB client access to trusted networks only via firewall rules on TCP 445/139, accepting the trade-off of reduced remote accessibility; (3) Limit SMB user accounts to least-privilege access and implement strict file ACLs, reducing impact of handle hijacking but not preventing the vulnerability; (4) Monitor kernel logs for unusual SMB2_CREATE DHnC requests from unexpected users via auditd rules, though this provides detection not prevention. The durable handle timeout setting cannot mitigate this issue as orphaned handles remain vulnerable during their entire lifetime. Patching remains the only complete fix. Reference: https://git.kernel.org/stable/c/c908c853f304a4969b5aa10eba0b50350cc65b80