CVE-2026-72044

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack buffer overflow exists in the ksmbd component during multichannel session-key copying. The issue occurs when the channel key buffer and per-channel sess key buffer are sized at 16 bytes (SMB2 NTLMV2 SESSKEY SIZE), while the length checks for incoming data allow up to 40 bytes (CIFS KEY SIZE). During a binding SESSION SETUP, a client providing an NTLM EncryptedRandomSessionKey up to 40 bytes or a Kerberos ticket with a session key longer than 16 bytes can trigger a kernel stack overflow of up to 24 bytes. This is specifically observed in the arc4 crypt() function called by ksmbd decode ntlmssp auth blob() and within the ksmbd krb5 authenticate() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.