CVE-2026-23364: Linux Kernel ksmbd Timing Attack Flaw

CVE-2026-23364 Overview

A timing attack vulnerability has been identified in the Linux kernel's ksmbd (SMB server) component. The vulnerability exists due to the use of memcmp() for Message Authentication Code (MAC) comparisons, which does not execute in constant time. This allows attackers to potentially extract sensitive cryptographic information by measuring the time differences in MAC validation responses.

Critical Impact
Attackers could exploit timing side-channel differences in MAC comparisons to gradually deduce valid authentication credentials or cryptographic material, potentially compromising SMB session security.

Affected Products

Linux kernel with ksmbd module enabled
Systems running ksmbd-based SMB file sharing services

Discovery Timeline

2026-03-25 - CVE CVE-2026-23364 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23364

Vulnerability Analysis

The vulnerability resides in the ksmbd kernel module, which implements an in-kernel SMB3 server for the Linux kernel. The core issue involves the improper use of memcmp() for comparing Message Authentication Codes during SMB authentication and message integrity verification processes.

Standard memory comparison functions like memcmp() are optimized for performance and return early upon finding the first mismatched byte. This early-exit behavior creates measurable timing differences that vary depending on how many bytes match between the compared values. An attacker can exploit these timing variations to systematically deduce valid MAC values one byte at a time.

The fix replaces memcmp() with crypto_memneq(), a cryptographically-safe comparison function that always examines all bytes regardless of match status, ensuring constant-time execution that prevents timing-based information leakage.

Root Cause

The root cause is the use of a non-constant-time comparison function (memcmp()) for security-sensitive cryptographic operations. When validating MACs in authentication contexts, the comparison operation must complete in the same amount of time regardless of how many bytes match, preventing attackers from gaining information through timing analysis. The kernel's crypto_memneq() function provides this guarantee by design.

Attack Vector

An attacker with network access to a ksmbd server could conduct a timing attack by:

Sending SMB requests with crafted MAC values to the target server
Measuring response times with high precision for each request
Iteratively adjusting MAC bytes and observing timing variations
Using statistical analysis of timing differences to deduce the correct MAC byte-by-byte

This attack requires the ability to make many authentication attempts and measure response times accurately, which is typically feasible on local networks or low-latency connections. The attack does not require any prior authentication to the SMB server.

Detection Methods for CVE-2026-23364

Indicators of Compromise

Unusual volume of SMB authentication failures from a single source IP
High-frequency connection attempts to ksmbd services with subtle variations in authentication parameters
Network traffic patterns showing systematic probing of SMB authentication endpoints
Anomalous timing patterns in SMB session establishment attempts

Detection Strategies

Monitor for repeated SMB authentication failures followed by subtle request modifications
Implement rate limiting on SMB authentication attempts to disrupt timing measurements
Use network intrusion detection systems (IDS) to identify potential timing attack patterns
Enable kernel audit logging for ksmbd authentication events

Monitoring Recommendations

Deploy network monitoring to track SMB connection frequency and authentication failure rates
Implement alerting for authentication anomalies in ksmbd logs
Consider using packet capture analysis to identify high-volume probing attempts
Monitor system logs for ksmbd-related errors or warnings

How to Mitigate CVE-2026-23364

Immediate Actions Required

Apply the latest kernel patches that include the constant-time MAC comparison fix
If immediate patching is not possible, consider temporarily disabling ksmbd and using userspace SMB implementations
Implement network-level access controls to limit exposure of ksmbd services
Enable enhanced logging for ksmbd authentication events

Patch Information

Multiple patches have been released to address this vulnerability across different kernel branches. The fix replaces memcmp() with crypto_memneq() in the MAC comparison code paths within ksmbd.

Available kernel patches:

Workarounds

Restrict network access to ksmbd services using firewall rules to trusted networks only
Consider using Samba userspace implementation instead of ksmbd until patching is complete
Implement network segmentation to isolate systems running vulnerable ksmbd configurations
Deploy rate limiting at the network level to impede timing attack execution

bash

# Disable ksmbd kernel module temporarily
sudo modprobe -r ksmbd

# Block external access to SMB ports via firewall
sudo iptables -A INPUT -p tcp --dport 445 -s ! 10.0.0.0/8 -j DROP
sudo iptables -A INPUT -p tcp --dport 139 -s ! 10.0.0.0/8 -j DROP