Executive brief
A vulnerability exists in the Linux kernel's SMB server (ksmbd), which provides file-sharing services. An attacker can manipulate the session keys used for secure communication even if they provide incorrect login credentials. This could allow an unauthorized user to interfere with the integrity of established network connections.
Technical details
A vulnerability in ksmbd_auth.c occurs because ksmbd_auth_ntlmv2() derives and updates the NTLMv2 session key (sess->sess_key) before verifying the NTLMv2 response. In SMB3 multichannel binding scenarios, the session setup error path fails to expire binding sessions. This allows a remote, unauthenticated attacker to send a binding session setup with an invalid NT proof and a Key Exchange (KEY_XCH) blob to modify the session key of an existing session before a logon failure is returned. The fix involves deriving the key into a local buffer and only committing it to the session structure after successful verification.
Affected products
- Linux Linux Kernel 5.15 to 6.18.40, 7.1.4
Timeline
- 2026-07-25: advisory: NVD publication date
- 2026-06-23: patched: Initial fix commit in kernel source