CVE-2026-64389

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where the ksmbd auth ntlmv2() function derives the NTLMv2 session key into sess->sess key before verifying the NTLMv2 response. Subsequently, ksmbd decode ntlmssp auth blob() may proceed to KEY XCH even if authentication fails. In scenarios involving SMB3 multichannel binding, a client can provide an invalid NT proof and KEY XCH to modify sess->sess key before a STATUS LOGON FAILURE is returned, as the session setup error path does not expire binding sessions. The execution flow involves smb2 sess setup(), ntlm authenticate(), session user(), ksmbd decode ntlmssp auth blob(), and ksmbd auth ntlmv2().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.