Look up another CVE · open CVE-2026-64389 in the interactive tracker

CVE-2026-64389

ksmbd: validate NTLMv2 response before updating session key

8.2 EPSS 0.5% AV:N

Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-64389 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	vulnerable	6.1.190-1	No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication.
Debian 13trixie	vulnerable	6.12.113-1	No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication.
Debian 14forky	fixed	7.1.4-1	Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.4-1	Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

ksmbd_auth_ntlmv2() derives the NTLMv2 session key into sess->sess_key before it verifies the NTLMv2 response. ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even when ksmbd_auth_ntlmv2() failed. With SMB3 multichannel binding, the failed authentication operates on an existing session and the session setup error path does not expire binding sessions. A client can send a binding session setup with a bad NT proof and KEY_XCH and still modify sess->sess_key before STATUS_LOGON_FAILURE is returned. Relevant path: smb2_sess_setup() -> conn->binding = true -> ntlm_authenticate() -> session_user() -> ksmbd_decode_ntlmssp_auth_blob() -> ksmbd_auth_ntlmv2() -> calc_ntlmv2_hash() -> hmac_md5_usingrawkey(..., sess->sess_key) -> crypto_memneq() returns mismatch -> KEY_XCH arc4_crypt(..., sess->sess_key, ...) -> out_err without expiring the binding session Derive the base session key into a local buffer and copy it to sess->sess_key only after the proof matches. Return immediately on authentication failure so KEY_XCH is only processed after successful authentication.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/smb/server/auth.c

What this is: KERNEL SMB3 SERVER (KSMBD)MAINTAINERS section matched on fs/smb/server/ · linux-cifs@vger.kernel.org · Maintained
Kernel module: ksmbd

Check it on the machine

grep -wE 'CONFIG_SMBFS|CONFIG_SMB_SERVER' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ksmbd

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switches: CONFIG_SMBFS, CONFIG_SMB_SERVER
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-25 (3 months ago)source
CVSS: 8.2 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.45%, higher than 37.9% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: fs/smb

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.15	6.18.40	b56400364aed
5.15	7.1.4	89ca7756d556
5.15	7.2	954d196bebb2

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: The vulnerable NTLMv2 authentication path is reached remotely through ksmbd SESSION_SETUP requests over SMB on TCP/445.
AC:LAttack complexity, low: An attacker can deterministically trigger the key overwrite using a malformed multichannel binding request with KEY_XCH; no race or condition beyond attacker control is required.
PR:NPrivileges required, none: The overwrite occurs before NTLMv2 proof validation, and the affected code does not verify the binding request signature, so valid credentials or an authenticated attacker session are unnecessary.
UI:NUser interaction, none: No victim action is required beyond an active SMB session, which can belong to an automated client or service.
S:UScope, unchanged: The corrupted session state and resulting effects remain within the ksmbd server and host kernel security authority.
C:NConfidentiality impact, none: The bounded session-key overwrite does not disclose the prior key, kernel memory, or protected SMB data.
I:LIntegrity impact, low: The attacker can modify an established session's security-critical key state, but cannot reliably select the resulting key or obtain an arbitrary memory or file-write primitive.
A:HAvailability impact, high: Repeated unauthenticated key corruption can desynchronize signing-key derivation and render targeted multichannel binding or session recovery unusable, causing complete loss of the affected SMB session in dependent deployments.