CVE-2026-68130

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the ntlm authenticate() function, the destroy previous session() function is called using a user pointer derived from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can manipulate the NTLM blob username to match a victim account and set the PreviousSessionId variable to the victim's session ID. This allows the attacker to trigger destroy previous session() to terminate the victim's session, even though ksmbd decode ntlmssp auth blob() subsequently rejects the request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.