CVE-2026-64389

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate NTLMv2 response before updating session key

ksmbd_auth_ntlmv2() derives the NTLMv2 session key into

sess->sess_key before it verifies the NTLMv2 response.

ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even

when ksmbd_auth_ntlmv2() failed.

With SMB3 multichannel binding, the failed authentication operates on

an existing session and the session setup error path does not expire

binding sessions. A client can send a binding session setup with a

bad NT proof and KEY_XCH and still modify sess->sess_key before

STATUS_LOGON_FAILURE is returned.

Relevant path:

smb2_sess_setup()

-> conn->binding = true

-> ntlm_authenticate()

-> session_user()

-> ksmbd_decode_ntlmssp_auth_blob()

-> ksmbd_auth_ntlmv2()

-> calc_ntlmv2_hash()

-> hmac_md5_usingrawkey(..., sess->sess_key)

-> crypto_memneq() returns mismatch

-> KEY_XCH

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References