CVE-2026-68130: ksmbd: defer destroy_previous_session() until after NTLM authentication
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: defer destroyprevioussession() until after NTLM authentication
In ntlmauthenticate(), destroyprevioussession() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroyprevioussession() destroys the victim's session while ksmbddecodentlmsspauthblob() subsequently rejects the request with -EPERM.
Move destroyprevioussession() and the previd assignment to after ksmbddecodentlmsspauthblob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5authenticate(), where destroyprevioussession() is called only after ksmbdkrb5authenticate() returns success.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68130?
CVE-2026-68130 has a risk rating of 33.
How do I fix CVE-2026-68130?
To mitigate CVE-2026-68130, ensure that your Linux kernel is updated to the latest version which includes the patch.
What systems are affected by CVE-2026-68130?
CVE-2026-68130 affects systems running specific versions of the Linux kernel with ksmbd.
What does CVE-2026-68130 exploit?
CVE-2026-68130 exploits a flaw in the NTLM authentication lifecycle in the ksmbd implementation of the Linux kernel.
When was CVE-2026-68130 published?
CVE-2026-68130 was published on August 10, 2026.