CVE-2026-68130 Overview
CVE-2026-68130 is a vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw resides in the ntlm_authenticate() function, where destroy_previous_session() executes using a user pointer derived from the client-supplied NTLM blob before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session identifier. The kernel destroys the victim's session even though ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM. The result is an authenticated cross-session denial-of-service against active SMB sessions on the ksmbd server.
Critical Impact
An authenticated SMB client can terminate other users' active sessions on a ksmbd server by referencing their session ID before NTLM authentication completes.
Affected Products
- Linux kernel ksmbd in-kernel SMB server
- Distributions shipping kernels with the pre-patch ntlm_authenticate() ordering
- Systems exposing SMB services via ksmbd
Discovery Timeline
- 2026-08-10 - CVE-2026-68130 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68130
Vulnerability Analysis
The vulnerability is a logic ordering flaw in the NTLM authentication path of ksmbd. Inside ntlm_authenticate(), the server resolves a user pointer from the attacker-controlled NTLM blob username field. It then invokes destroy_previous_session() on that user's PreviousSessionId before validating the NTLMv2 response. Because the destructive action precedes cryptographic validation, an attacker who can authenticate with any valid account can influence session state belonging to other users.
The attacker crafts an SMB session setup request where the NTLM blob username identifies a victim account and PreviousSessionId names an active session ID belonging to that victim. ksmbd looks up the victim user, calls destroy_previous_session() against the referenced session, and only afterwards evaluates the NTLMv2 challenge response. When the response fails validation, ksmbd_decode_ntlmssp_auth_blob() returns -EPERM, but the victim session has already been torn down.
The upstream fix moves destroy_previous_session() and the prev_id assignment to execute only after ksmbd_decode_ntlmssp_auth_blob() succeeds. The patched code uses sess->user from the authenticated session rather than the pre-authentication lookup result. This mirrors the ordering already present in krb5_authenticate().
Root Cause
The root cause is a Time-of-Check to Time-of-Use style ordering defect. State-modifying operations execute against attacker-supplied identifiers before authentication verifies the caller's right to reference those identifiers.
Attack Vector
An attacker with any valid SMB credential connects to the ksmbd server and issues a session setup request. The NTLM authentication blob is crafted with the victim's username and the victim's active session ID in the PreviousSessionId field. The NTLMv2 response can be invalid. The session teardown occurs before validation fails.
Refer to the upstream commits Kernel.org Patch 0ff1230 and Kernel.org Patch 243f161 for the exact code changes.
Detection Methods for CVE-2026-68130
Indicators of Compromise
- Repeated SMB session setup failures returning -EPERM from ksmbd_decode_ntlmssp_auth_blob() in kernel logs
- Unexpected termination of active SMB sessions coinciding with failed authentication attempts from remote clients
- Multiple PreviousSessionId values referenced from a single client IP across short time windows
Detection Strategies
- Monitor dmesg and /var/log/kern.log for ksmbd authentication failure messages correlated with session destruction events
- Correlate SMB session teardown events with the source IP and username of the preceding authentication attempt
- Alert on authenticated clients that reference PreviousSessionId values not previously associated with their own account
Monitoring Recommendations
- Enable verbose ksmbd logging where supported to capture session lifecycle transitions
- Forward kernel and SMB server logs to a centralized SIEM for correlation across hosts
- Baseline normal session establishment patterns per user to surface anomalous session destruction sequences
How to Mitigate CVE-2026-68130
Immediate Actions Required
- Apply the upstream stable kernel patches referenced below to any Linux host running ksmbd
- Restrict SMB service exposure to trusted network segments using host or perimeter firewall rules
- Audit ksmbd user accounts and disable unused or shared credentials that could enable authenticated abuse
Patch Information
The fix reorders destroy_previous_session() to run only after ksmbd_decode_ntlmssp_auth_blob() returns success and uses sess->user instead of the pre-authentication lookup. Apply one of the upstream stable patches: Kernel.org Patch 0ff1230, Kernel.org Patch 18705ca, Kernel.org Patch 243f161, Kernel.org Patch 5c8330, or Kernel.org Patch c74801e.
Workarounds
- Stop and disable the ksmbd service on hosts that do not require in-kernel SMB serving; consider Samba smbd as an alternative pending patching
- Require Kerberos authentication where possible, since the vulnerable ordering is specific to the NTLM path
- Limit SMB accessibility with firewall policies restricting TCP/445 to authorized clients only
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
