CVE-2026-68130
ksmbd: defer destroy_previous_session() until after NTLM authentication
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroy_previous_session() until after NTLM authentication In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM. Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success.
References
- https://git.kernel.org/stable/c/ab0230257ebdf48b07eaa679a8c92bc842fe3498
- https://git.kernel.org/stable/c/370b0ec8822b69c9073265e16b7daaa8201c9a4f
- https://git.kernel.org/stable/c/5c833074b549e5db125436a6f681af682261f785
- https://git.kernel.org/stable/c/243f1614ef2aca2d62a744575f1c24b07cd42757
- https://git.kernel.org/stable/c/18705cace0619fd2123737dcd028147774f38181
- https://git.kernel.org/stable/c/0ff12308c8a6c16ab68f0a487ffa93d69001dc18
- https://git.kernel.org/stable/c/c74801ee524f477c174a1899782b6c3b6918d407
European references
- ENISA EUVD · EUVD-2026-55511
- GCVE · GCVE-0-2026-68130
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1069 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < ab0230257ebdf48b07eaa679a8c92bc842fe3498 ; affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 370b0ec8822b69c9073265e16b7daaa8201c9a4f ; affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 5c833074b549e5db125436a6f681af682261f785 ; affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 243f1614ef2aca2d62a744575f1c24b07cd42757 ; affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 18705cace0619fd2123737dcd028147774f38181 ; affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 0ff12308c8a6c16ab68f0a487ffa93d69001dc18 |
| Linux · Linux | affected 5.15 ; unaffected 0 < 5.15 ; unaffected 5.15.217 ≤ 5.15.* ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.148 ≤ 6.6.* ; unaffected 6.12.101 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |