CVE-2026-68130
Received Received - Intake

ksmbd Session Hijacking via NTLM Authentication

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroy_previous_session() until after NTLM authentication In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM. Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68130
EUVD
EUVD-2026-55511

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel ksmbd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's ksmbd component involves an issue where destroy_previous_session() is called prematurely during NTLM authentication. An attacker can manipulate the NTLM blob username field to match a victim's account and set PreviousSessionId to the victim's session ID. This causes the victim's session to be destroyed before authentication is validated, leading to potential denial of service or unauthorized access.

Detection Guidance

This vulnerability affects the ksmbd component in the Linux kernel. Detection requires checking if your system uses a vulnerable kernel version with ksmbd enabled. Inspect kernel logs for ksmbd-related errors or crashes during NTLM authentication attempts. Commands like dmesg | grep ksmbd or journalctl -u ksmbd may help identify suspicious activity.

Impact Analysis

If exploited, this vulnerability could allow an authenticated attacker to disrupt legitimate user sessions by destroying them before authentication completes. This may result in denial of service for affected users or enable further unauthorized actions depending on the system's configuration and the attacker's goals.

Mitigation Strategies

Update your Linux kernel to the latest patched version that resolves this issue. Disable ksmbd if not needed by unloading the module with rmmod ksmbd or disabling the service. Monitor for unusual session terminations or authentication failures in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68130. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart