CVE-2026-64389: Linux Kernel Auth Bypass Vulnerability

CVE-2026-64389 Overview

CVE-2026-64389 is a Linux kernel vulnerability in the ksmbd in-kernel SMB3 server. The flaw resides in ksmbd_auth_ntlmv2(), which writes the derived NTLMv2 session key into sess->sess_key before verifying the client's NTLMv2 response. When SMB3 multichannel binding is used, an unauthenticated network attacker can send a binding session setup with an invalid NT proof and still mutate the session key of an existing session before STATUS_LOGON_FAILURE is returned.

Critical Impact
A remote attacker can corrupt an active SMB3 session's cryptographic key material without valid credentials, breaking session integrity and enabling denial of service against authenticated SMB clients.

Affected Products

Linux kernel ksmbd SMB3 server module
Distributions shipping vulnerable ksmbd builds prior to the fix commits
SMB3 deployments with multichannel binding enabled

Discovery Timeline

2026-07-25 - CVE-2026-64389 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64389

Vulnerability Analysis

The vulnerability exists in the NTLMv2 authentication path of the ksmbd kernel SMB server. ksmbd_auth_ntlmv2() derives the base session key using hmac_md5_usingrawkey() and writes it directly into sess->sess_key before calling crypto_memneq() to compare the client's NT proof.

When the proof comparison fails, the function returns an error, but the session key field has already been overwritten. The caller ksmbd_decode_ntlmssp_auth_blob() then proceeds into the KEY_XCH branch and calls arc4_crypt() using the attacker-influenced sess->sess_key, further mutating cryptographic state before the error is surfaced.

SMB3 multichannel binding amplifies the impact. Binding session setup operates on an existing authenticated session, and the smb2_sess_setup() error path does not expire binding sessions on failure. A remote attacker can therefore repeatedly submit crafted binding requests to modify session key material for a legitimate session.

Root Cause

The root cause is an ordering flaw between key derivation and response validation. The code writes trusted cryptographic material to the shared session structure before authenticating the source of that material, violating the check-then-use principle.

Attack Vector

Exploitation requires network reachability to the ksmbd service and an existing SMB3 session with multichannel binding. The attacker sends a session setup request with the binding flag set, supplies a malformed NTLMv2 NT proof, and includes a KEY_XCH payload. Authentication fails, but sess->sess_key is corrupted for the target session before the failure is returned.

Refer to the upstream fixes at Kernel Git Commit 89ca775, Kernel Git Commit 954d196, and Kernel Git Commit b564003 for the corrective patches that derive the base key into a local buffer and copy it to sess->sess_key only after the proof matches.

Detection Methods for CVE-2026-64389

Indicators of Compromise

Repeated STATUS_LOGON_FAILURE responses from ksmbd correlated with session binding requests from unexpected source addresses.
Kernel log entries from ksmbd indicating NTLMv2 authentication failures on already-established sessions.
Abrupt SMB session termination or signing/encryption errors reported by legitimate SMB clients following failed binding attempts.

Detection Strategies

Monitor SMB3 session setup traffic for binding requests (SMB2_SESSION_FLAG_BINDING) that terminate in authentication failure.
Correlate ksmbd kernel messages with network flows to identify sources issuing malformed NTLMv2 responses against active sessions.
Alert on unexpected SMB session invalidation events affecting authenticated users shortly after external binding attempts.

Monitoring Recommendations

Enable verbose ksmbd logging on affected hosts and ship kernel logs to a centralized analytics platform for correlation.
Track the running kernel version and ksmbd module version across the Linux fleet to identify unpatched hosts.
Baseline expected SMB3 multichannel binding sources and alert on deviations.

How to Mitigate CVE-2026-64389

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree as soon as vendor-rebuilt kernels become available.
Inventory all Linux hosts running ksmbd and prioritize patching for internet-exposed or multi-tenant SMB servers.
Restrict SMB3 (TCP/445) exposure to trusted network segments using host and network firewalls.

Patch Information

The fix reorders NTLMv2 validation so that the derived session key is stored in a local buffer and copied to sess->sess_key only after crypto_memneq() confirms the NT proof. The function now returns immediately on authentication failure, preventing KEY_XCH processing on invalid credentials. Corrective commits are available at Kernel Git Commit 89ca775, Kernel Git Commit 954d196, and Kernel Git Commit b564003.

Workarounds

Disable the ksmbd kernel module on hosts that do not require an in-kernel SMB server and use userspace Samba instead.
Disable SMB3 multichannel on ksmbd shares where operationally acceptable to remove the binding attack path.
Enforce strict source-address filtering on TCP/445 to limit which clients can initiate session binding requests.

bash

# Configuration example: unload ksmbd and block SMB where not required
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
sudo iptables -A INPUT -p tcp --dport 445 -j DROP