CVE-2026-23364: Linux Kernel ksmbd Timing Attack Flaw

CVE-2026-23364 Overview

A timing attack vulnerability has been identified in the Linux kernel's ksmbd (SMB server) component. The vulnerability exists due to the use of memcmp() for Message Authentication Code (MAC) comparisons, which does not execute in constant time. This allows attackers to potentially extract sensitive cryptographic information by measuring the time differences in MAC validation responses.

Critical Impact

Attackers could exploit timing side-channel differences in MAC comparisons to gradually deduce valid authentication credentials or cryptographic material, potentially compromising SMB session security.

Affected Products

• Linux kernel with ksmbd module enabled
• Systems running ksmbd-based SMB file sharing services

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23364 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23364

Vulnerability Analysis

The vulnerability resides in the ksmbd kernel module, which implements an in-kernel SMB3 server for the Linux kernel. The core issue involves the improper use of memcmp() for comparing Message Authentication Codes during SMB authentication and message integrity verification processes.

Standard memory comparison functions like memcmp() are optimized for performance and return early upon finding the first mismatched byte. This early-exit behavior creates measurable timing differences that vary depending on how many bytes match between the compared values. An attacker can exploit these timing variations to systematically deduce valid MAC values one byte at a time.

The fix replaces memcmp() with crypto_memneq(), a cryptographically-safe comparison function that always examines all bytes regardless of match status, ensuring constant-time execution that prevents timing-based information leakage.

Root Cause

The root cause is the use of a non-constant-time comparison function (memcmp()) for security-sensitive cryptographic operations. When validating MACs in authentication contexts, the comparison operation must complete in the same amount of time regardless of how many bytes match, preventing attackers from gaining information through timing analysis. The kernel's crypto_memneq() function provides this guarantee by design.

Attack Vector

An attacker with network access to a ksmbd server could conduct a timing attack by:

1. Sending SMB requests with crafted MAC values to the target server
2. Measuring response times with high precision for each request
3. Iteratively adjusting MAC bytes and observing timing variations
4. Using statistical analysis of timing differences to deduce the correct MAC byte-by-byte

This attack requires the ability to make many authentication attempts and measure response times accurately, which is typically feasible on local networks or low-latency connections. The attack does not require any prior authentication to the SMB server.

Detection Methods for CVE-2026-23364

Indicators of Compromise

• Unusual volume of SMB authentication failures from a single source IP
• High-frequency connection attempts to ksmbd services with subtle variations in authentication parameters
• Network traffic patterns showing systematic probing of SMB authentication endpoints
• Anomalous timing patterns in SMB session establishment attempts

Detection Strategies

• Monitor for repeated SMB authentication failures followed by subtle request modifications
• Implement rate limiting on SMB authentication attempts to disrupt timing measurements
• Use network intrusion detection systems (IDS) to identify potential timing attack patterns
• Enable kernel audit logging for ksmbd authentication events

Monitoring Recommendations

• Deploy network monitoring to track SMB connection frequency and authentication failure rates
• Implement alerting for authentication anomalies in ksmbd logs
• Consider using packet capture analysis to identify high-volume probing attempts
• Monitor system logs for ksmbd-related errors or warnings

How to Mitigate CVE-2026-23364

Immediate Actions Required

• Apply the latest kernel patches that include the constant-time MAC comparison fix
• If immediate patching is not possible, consider temporarily disabling ksmbd and using userspace SMB implementations
• Implement network-level access controls to limit exposure of ksmbd services
• Enable enhanced logging for ksmbd authentication events

Patch Information

Multiple patches have been released to address this vulnerability across different kernel branches. The fix replaces memcmp() with crypto_memneq() in the MAC comparison code paths within ksmbd.

Available kernel patches:

• Kernel Patch Commit 2cdc56e
• Kernel Patch Commit 307afcc
• Kernel Patch Commit 93c0a22
• Kernel Patch Commit c579470
• Kernel Patch Commit cd52a0e
• Kernel Patch Commit f4588b85

Workarounds

• Restrict network access to ksmbd services using firewall rules to trusted networks only
• Consider using Samba userspace implementation instead of ksmbd until patching is complete
• Implement network segmentation to isolate systems running vulnerable ksmbd configurations
• Deploy rate limiting at the network level to impede timing attack execution

# Disable ksmbd kernel module temporarily
sudo modprobe -r ksmbd

# Block external access to SMB ports via firewall
sudo iptables -A INPUT -p tcp --dport 445 -s ! 10.0.0.0/8 -j DROP
sudo iptables -A INPUT -p tcp --dport 139 -s ! 10.0.0.0/8 -j DROP