CVE-2026-68130

Summary

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer destroy_previous_session() until after NTLM authentication

In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM.

Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 5c833074b549e5db125436a6f681af682261f785affected
LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 243f1614ef2aca2d62a744575f1c24b07cd42757affected
LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 18705cace0619fd2123737dcd028147774f38181affected
LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 0ff12308c8a6c16ab68f0a487ffa93d69001dc18affected
LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < c74801ee524f477c174a1899782b6c3b6918d407affected
LinuxLinux5.15affected
LinuxLinux0 < 5.15unaffected
LinuxLinux6.6.148 <= 6.6.*unaffected
LinuxLinux6.12.101 <= 6.12.*unaffected
LinuxLinux6.18.42 <= 6.18.*unaffected
LinuxLinux7.1.6 <= 7.1.*unaffected
LinuxLinux7.2-rc5 <= *unaffected

Weaknesses

References