CVE-2026-64389

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate NTLMv2 response before updating session key

ksmbd_auth_ntlmv2() derives the NTLMv2 session key into

sess->sess_key before it verifies the NTLMv2 response.

ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even

when ksmbd_auth_ntlmv2() failed.

With SMB3 multichannel binding, the failed authentication operates on

an existing session and the session setup error path does not expire

binding sessions. A client can send a binding session setup with a

bad NT proof and KEY_XCH and still modify sess->sess_key before

STATUS_LOGON_FAILURE is returned.

Relevant path:

smb2_sess_setup()

-> conn->binding = true

-> ntlm_authenticate()

-> session_user()

-> ksmbd_decode_ntlmssp_auth_blob()

-> ksmbd_auth_ntlmv2()

-> calc_ntlmv2_hash()

-> hmac_md5_usingrawkey(..., sess->sess_key)

-> crypto_memneq() returns mismatch

-> KEY_XCH arc4_crypt(..., sess->sess_key, ...)

-> out_err without expiring the binding session

Derive the base session key into a local buffer and copy it to

sess->sess_key only after the proof matches. Return immediately on

authentication failure so KEY_XCH is only processed after successful

authentication.