CVE-2026-64389: ksmbd: validate NTLMv2 response before updating session key

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate NTLMv2 response before updating session key

ksmbd_auth_ntlmv2() derives the NTLMv2 session key into
sess->sess_key before it verifies the NTLMv2 response.
ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even
when ksmbd_auth_ntlmv2() failed.

With SMB3 multichannel binding, the failed authentication operates on
an existing session and the session setup error path does not expire
binding sessions. A client can send a binding session setup with a
bad NT proof and KEY_XCH and still modify sess->sess_key before
STATUS_LOGON_FAILURE is returned.

Relevant path:

  smb2_sess_setup()
    -> conn->binding = true
    -> ntlm_authenticate()
       -> session_user()
       -> ksmbd_decode_ntlmssp_auth_blob()
          -> ksmbd_auth_ntlmv2()
             -> calc_ntlmv2_hash()
             -> hmac_md5_usingrawkey(..., sess->sess_key)
             -> crypto_memneq() returns mismatch
          -> KEY_XCH arc4_crypt(..., sess->sess_key, ...)
    -> out_err without expiring the binding session

Derive the base session key into a local buffer and copy it to
sess->sess_key only after the proof matches. Return immediately on
authentication failure so KEY_XCH is only processed after successful
authentication.

The Linux kernel CVE team has assigned CVE-2026-64389 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 and fixed in 6.18.40 with commit b56400364aed5c34d6e1a0b493081290a5328a9c
	Issue introduced in 5.15 with commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 and fixed in 7.1.4 with commit 89ca7756d5566ba636bb9092cdbe57dab095e136
	Issue introduced in 5.15 with commit e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 and fixed in 7.2-rc1 with commit 954d196bebb2b50151cb96454c72dc113b2af1ac

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64389
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/server/auth.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c
	https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136
	https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac