The Linux kernel's ksmbd_auth_ntlmv2() function previously derived the NTLMv2 session key into sess->sess_key before verifying the NTLMv2 response. If authentication failed, ksmbd_decode_ntlmssp_auth_blob() still proceeded to the KEY_XCH phase, allowing modification of sess->sess_key despite the failure. With SMB3 multichannel binding, this flaw allowed a client to send a binding session setup with an invalid NT proof and still alter the session key before a STATUS_LOGON_FAILURE was returned. The fix involves deriving the session key into a local buffer and only copying it to sess->sess_key after successful proof validation, ensuring KEY_XCH processing occurs only after authentication succeeds.

An attacker could potentially manipulate the session key during a failed authentication attempt in SMB3 multichannel binding scenarios, which may affect session integrity and security. No known exploits in the wild have been reported. The vulnerability could lead to unauthorized session key modification before authentication failure is enforced.

A fix has been implemented in the Linux kernel to address this vulnerability by validating the NTLMv2 response before updating the session key. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation requires updating affected Linux kernel versions once the patch is available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.