CVE-2026-64389 (GCVE-0-2026-64389)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
Title
ksmbd: validate NTLMv2 response before updating session key
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives the NTLMv2 session key into sess->sess_key before it verifies the NTLMv2 response. ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even when ksmbd_auth_ntlmv2() failed. With SMB3 multichannel binding, the failed authentication operates on an existing session and the session setup error path does not expire binding sessions. A client can send a binding session setup with a bad NT proof and KEY_XCH and still modify sess->sess_key before STATUS_LOGON_FAILURE is returned. Relevant path: smb2_sess_setup() -> conn->binding = true -> ntlm_authenticate() -> session_user() -> ksmbd_decode_ntlmssp_auth_blob() -> ksmbd_auth_ntlmv2() -> calc_ntlmv2_hash() -> hmac_md5_usingrawkey(..., sess->sess_key) -> crypto_memneq() returns mismatch -> KEY_XCH arc4_crypt(..., sess->sess_key, ...) -> out_err without expiring the binding session Derive the base session key into a local buffer and copy it to sess->sess_key only after the proof matches. Return immediately on authentication failure so KEY_XCH is only processed after successful authentication.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < b56400364aed5c34d6e1a0b493081290a5328a9c (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 89ca7756d5566ba636bb9092cdbe57dab095e136 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 954d196bebb2b50151cb96454c72dc113b2af1ac (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b56400364aed5c34d6e1a0b493081290a5328a9c",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "89ca7756d5566ba636bb9092cdbe57dab095e136",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "954d196bebb2b50151cb96454c72dc113b2af1ac",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate NTLMv2 response before updating session key\n\nksmbd_auth_ntlmv2() derives the NTLMv2 session key into\nsess-\u003esess_key before it verifies the NTLMv2 response.\nksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even\nwhen ksmbd_auth_ntlmv2() failed.\n\nWith SMB3 multichannel binding, the failed authentication operates on\nan existing session and the session setup error path does not expire\nbinding sessions. A client can send a binding session setup with a\nbad NT proof and KEY_XCH and still modify sess-\u003esess_key before\nSTATUS_LOGON_FAILURE is returned.\n\nRelevant path:\n\n  smb2_sess_setup()\n    -\u003e conn-\u003ebinding = true\n    -\u003e ntlm_authenticate()\n       -\u003e session_user()\n       -\u003e ksmbd_decode_ntlmssp_auth_blob()\n          -\u003e ksmbd_auth_ntlmv2()\n             -\u003e calc_ntlmv2_hash()\n             -\u003e hmac_md5_usingrawkey(..., sess-\u003esess_key)\n             -\u003e crypto_memneq() returns mismatch\n          -\u003e KEY_XCH arc4_crypt(..., sess-\u003esess_key, ...)\n    -\u003e out_err without expiring the binding session\n\nDerive the base session key into a local buffer and copy it to\nsess-\u003esess_key only after the proof matches. Return immediately on\nauthentication failure so KEY_XCH is only processed after successful\nauthentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable NTLMv2 authentication path is reached remotely through ksmbd SESSION_SETUP requests over SMB on TCP/445.\nAC:L - An attacker can deterministically trigger the key overwrite using a malformed multichannel binding request with KEY_XCH; no race or condition beyond attacker control is required.\nPR:N - The overwrite occurs before NTLMv2 proof validation, and the affected code does not verify the binding request signature, so valid credentials or an authenticated attacker session are unnecessary.\nUI:N - No victim action is required beyond an active SMB session, which can belong to an automated client or service.\nS:U - The corrupted session state and resulting effects remain within the ksmbd server and host kernel security authority.\nC:N - The bounded session-key overwrite does not disclose the prior key, kernel memory, or protected SMB data.\nI:L - The attacker can modify an established session\u0027s security-critical key state, but cannot reliably select the resulting key or obtain an arbitrary memory or file-write primitive.\nA:H - Repeated unauthenticated key corruption can desynchronize signing-key derivation and render targeted multichannel binding or session recovery unusable, causing complete loss of the affected SMB session in dependent deployments."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:41.641Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136"
        },
        {
          "url": "https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac"
        }
      ],
      "title": "ksmbd: validate NTLMv2 response before updating session key",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64389",
    "datePublished": "2026-07-25T08:50:36.817Z",
    "dateReserved": "2026-07-19T15:36:31.785Z",
    "dateUpdated": "2026-08-17T04:54:41.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64389",
      "date": "2026-10-04",
      "epss": "0.00453",
      "percentile": "0.37145"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:51:36.000Z",
      "cve": "CVE-2026-64389",
      "id": "msrc_CVE-2026-64389",
      "initial_release_date": "2026-07-26T01:09:32.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: validate NTLMv2 response before updating session key",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64389.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/auth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b56400364aed5c34d6e1a0b493081290a5328a9c",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "89ca7756d5566ba636bb9092cdbe57dab095e136",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "954d196bebb2b50151cb96454c72dc113b2af1ac",
                    "status": "affected",
                    "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/auth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DBEC5A00-0484-47F0-BD82-5461DC6C7A5C",
                    "versionEndExcluding": "6.18.40",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate NTLMv2 response before updating session key\n\nksmbd_auth_ntlmv2() derives the NTLMv2 session key into\nsess-\u003esess_key before it verifies the NTLMv2 response.\nksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even\nwhen ksmbd_auth_ntlmv2() failed.\n\nWith SMB3 multichannel binding, the failed authentication operates on\nan existing session and the session setup error path does not expire\nbinding sessions. A client can send a binding session setup with a\nbad NT proof and KEY_XCH and still modify sess-\u003esess_key before\nSTATUS_LOGON_FAILURE is returned.\n\nRelevant path:\n\n  smb2_sess_setup()\n    -\u003e conn-\u003ebinding = true\n    -\u003e ntlm_authenticate()\n       -\u003e session_user()\n       -\u003e ksmbd_decode_ntlmssp_auth_blob()\n          -\u003e ksmbd_auth_ntlmv2()\n             -\u003e calc_ntlmv2_hash()\n             -\u003e hmac_md5_usingrawkey(..., sess-\u003esess_key)\n             -\u003e crypto_memneq() returns mismatch\n          -\u003e KEY_XCH arc4_crypt(..., sess-\u003esess_key, ...)\n    -\u003e out_err without expiring the binding session\n\nDerive the base session key into a local buffer and copy it to\nsess-\u003esess_key only after the proof matches. Return immediately on\nauthentication failure so KEY_XCH is only processed after successful\nauthentication."
          }
        ],
        "id": "CVE-2026-64389",
        "lastModified": "2026-09-04T19:06:31.960",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:22.227",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-30T14:35:40+00:00",
      "cve": "CVE-2026-64389",
      "id": "CVE-2026-64389",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: validate NTLMv2 response before updating session key",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64389.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:50:19Z",
      "cve": "CVE-2026-64389",
      "id": "CVE-2026-64389",
      "initial_release_date": "2026-07-25T16:00:16Z",
      "product_status:known_affected": "125",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64389",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64389.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.