Executive brief
A security vulnerability exists in the Linux kernel's ksmbd component, which provides file-sharing services over a network. The system uses a non-secure method to verify security codes (MACs), which could allow an attacker to guess these codes by measuring how long the system takes to respond. If successful, an attacker could potentially bypass authentication or tamper with network traffic, compromising sensitive data.
Technical details
The ksmbd server in the Linux kernel used the standard memcmp() function to validate Message Authentication Codes (MACs) in NTLMv2 and SMB2/3 signature verification. Because memcmp() returns early upon finding a mismatch, it introduces a timing side-channel that can be exploited to leak information about the correct MAC. An attacker could potentially use this timing information to forge valid signatures or bypass authentication. The vulnerability was resolved by replacing memcmp() with crypto_memneq(), which ensures constant-time comparison regardless of the data being compared. The fix affects fs/smb/server/auth.c and fs/smb/server/smb2pdu.c.
Affected products
- Linux Linux Kernel 5.15 to 7.0
Timeline
- 2026-03-25: advisory: CVE-2026-23364 published by NVD
- 2026-03-25: patched: Fixes committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/2cdc56ed67615ba0921383a688f24415ebe065f3
- https://git.kernel.org/stable/c/307afccb751f542246bd5dc68a2c1ffe1a78418c
- https://git.kernel.org/stable/c/8a665d733940592e671ec6afadcd0be80a091a80
- https://git.kernel.org/stable/c/93c0a22fec914ec4b697e464895a0f594e29fb28
- https://git.kernel.org/stable/c/c5794709bc9105935dbedef8b9cf9c06f2b559fa
- https://git.kernel.org/stable/c/cd52a0e309659537048a864211abc3ea4c5caa63
- https://git.kernel.org/stable/c/f4588b85efd6007d46b80aa1b9fb746628ffb3dc