CVE-2026-68130

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer destroy_previous_session() until after NTLM authentication

In ntlm_authenticate(), destroy_previous_session() is called using a

user pointer resolved from the client-supplied NTLM blob username field

before the NTLMv2 response is validated. An authenticated attacker can

set the NTLM blob username to match a victim account and set

PreviousSessionId to the victim's session ID; destroy_previous_session()

destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob()

subsequently rejects the request with -EPERM.

Move destroy_previous_session() and the prev_id assignment to after

ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user

rather than the pre-authentication lookup result. This matches the

ordering already used by krb5_authenticate(), where

destroy_previous_session() is called only after

ksmbd_krb5_authenticate() returns success.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References