CVE-2026-64389

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: validate NTLMv2 response before updating session key<br /> <br /> ksmbd_auth_ntlmv2() derives the NTLMv2 session key into<br /> sess-&gt;sess_key before it verifies the NTLMv2 response.<br /> ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even<br /> when ksmbd_auth_ntlmv2() failed.<br /> <br /> With SMB3 multichannel binding, the failed authentication operates on<br /> an existing session and the session setup error path does not expire<br /> binding sessions. A client can send a binding session setup with a<br /> bad NT proof and KEY_XCH and still modify sess-&gt;sess_key before<br /> STATUS_LOGON_FAILURE is returned.<br /> <br /> Relevant path:<br /> <br /> smb2_sess_setup()<br /> -&gt; conn-&gt;binding = true<br /> -&gt; ntlm_authenticate()<br /> -&gt; session_user()<br /> -&gt; ksmbd_decode_ntlmssp_auth_blob()<br /> -&gt; ksmbd_auth_ntlmv2()<br /> -&gt; calc_ntlmv2_hash()<br /> -&gt; hmac_md5_usingrawkey(..., sess-&gt;sess_key)<br /> -&gt; crypto_memneq() returns mismatch<br /> -&gt; KEY_XCH arc4_crypt(..., sess-&gt;sess_key, ...)<br /> -&gt; out_err without expiring the binding session<br /> <br /> Derive the base session key into a local buffer and copy it to<br /> sess-&gt;sess_key only after the proof matches. Return immediately on<br /> authentication failure so KEY_XCH is only processed after successful<br /> authentication.