CVE-2026-64389: ksmbd: validate NTLMv2 response before updating session key
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate NTLMv2 response before updating session key
ksmbdauthntlmv2() derives the NTLMv2 session key into sess->sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob() then continues into KEYXCH even when ksmbdauthntlmv2() failed.
With SMB3 multichannel binding, the failed authentication operates on an existing session and the session setup error path does not expire binding sessions. A client can send a binding session setup with a bad NT proof and KEYXCH and still modify sess->sesskey before STATUSLOGONFAILURE is returned.
Relevant path:
smb2sesssetup() -> conn->binding = true -> ntlmauthenticate() -> sessionuser() -> ksmbddecodentlmsspauthblob() -> ksmbdauthntlmv2() -> calcntlmv2hash() -> hmacmd5usingrawkey(..., sess->sesskey) -> cryptomemneq() returns mismatch -> KEYXCH arc4crypt(..., sess->sesskey, ...) -> outerr without expiring the binding session
Derive the base session key into a local buffer and copy it to sess->sesskey only after the proof matches. Return immediately on authentication failure so KEYXCH is only processed after successful authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify ksmbd authentication flow so that ksmbd_auth_ntlmv2() / ksmbd_decode_ntlmssp_auth_blob() validate the NTLMv2 response (“proof matches”) before processing KEY_XCH or updating sess->sess_key. Also return immediately when STATUS_LOGON_FAILURE is returned, so the error path does not leave a binding session where KEY_XCH can be processed after failed authentication.
Linux kernel ksmbd (SMB3 multichannel binding) ksmbd_auth_ntlmv2() NTLMv2 validation order / session key update behavior = Validate NTLMv2 proof before updating sess->sess_key; return immediately on STATUS_LOGON_FAILURE
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64389?
CVE-2026-64389 has a severity rating of high, with a CVSS score of 8.2.
How do I fix CVE-2026-64389?
To mitigate CVE-2026-64389, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What impact does CVE-2026-64389 have on my system?
CVE-2026-64389 can lead to unauthorized access because session keys may be derived without proper validation.
Which software is affected by CVE-2026-64389?
CVE-2026-64389 affects the ksmbd component of the Linux kernel.
When was CVE-2026-64389 published?
CVE-2026-64389 was published on July 25, 2026.