CVE-2026-68130

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer destroy_previous_session() until after NTLM authentication

In ntlm_authenticate(), destroy_previous_session() is called using a

user pointer resolved from the client-supplied NTLM blob username field

before the NTLMv2 response is validated. An authenticated attacker can

set the NTLM blob username to match a victim account and set

PreviousSessionId to the victim's session ID; destroy_previous_session()

destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob()

subsequently rejects the request with -EPERM.

Move destroy_previous_session() and the prev_id assignment to after

ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user

rather than the pre-authentication lookup result. This matches the

ordering already used by krb5_authenticate(), where

destroy_previous_session() is called only after

ksmbd_krb5_authenticate() returns success.