CVE-2026-64389

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Linux Kernel ksmbd

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives the NTLMv2 session key into sess->sess_key before it verifies the NTLMv2 response. ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even when ksmbd_auth_ntlmv2() failed. With SMB3 multichannel binding, the failed authentication operates on an existing session and the session setup error path does not expire binding sessions. A client can send a binding session setup with a bad NT proof and KEY_XCH and still modify sess->sess_key before STATUS_LOGON_FAILURE is returned. Relevant path: smb2_sess_setup() -> conn->binding = true -> ntlm_authenticate() -> session_user() -> ksmbd_decode_ntlmssp_auth_blob() -> ksmbd_auth_ntlmv2() -> calc_ntlmv2_hash() -> hmac_md5_usingrawkey(..., sess->sess_key) -> crypto_memneq() returns mismatch -> KEY_XCH arc4_crypt(..., sess->sess_key, ...) -> out_err without expiring the binding session Derive the base session key into a local buffer and copy it to sess->sess_key only after the proof matches. Return immediately on authentication failure so KEY_XCH is only processed after successful authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64389

EUVD

EUVD-2026-48933

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	ksmbd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of NTLMv2 authentication in the ksmbd component. The issue occurs when the session key is derived before verifying the NTLMv2 response, allowing an attacker to modify the session key even after authentication fails. This can lead to unauthorized access or session manipulation.

Detection Guidance

This vulnerability affects the Linux kernel's ksmbd implementation. Detection requires checking kernel version and ksmbd module status. Use commands like 'uname -a' to check kernel version and 'lsmod | grep ksmbd' to verify if ksmbd is loaded. Monitor logs for failed SMB authentication attempts or unusual session key modifications.

Impact Analysis

If exploited, this vulnerability could allow an attacker to bypass authentication, gain unauthorized access to SMB shares, or manipulate existing sessions. Systems using ksmbd for SMB services are at risk, potentially leading to data breaches or unauthorized file access.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if exploited, resulting in legal penalties or reputational damage.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Disable ksmbd module if not required using 'modprobe -r ksmbd'. Restrict SMB access via firewall rules. Monitor for suspicious authentication attempts and apply vendor patches immediately.

Hi! I’m here to help you understand CVE-2026-64389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70