Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2()… (CVE-2026-64389)
A vulnerability in the Linux kernel's ksmbd component allowed an NTLMv2 response to be used to update a session key before proper validation, potentially enabling unauthorized modification of session keys during SMB3 multichannel binding. This flaw was addressed in Linux kernel updates. The vulnerability has a CVSS score of 8.2 and is considered medium severity. Multiple Linux kernel versions prior to 7.0.0-31.31 and related builds are affected. A patch is available and should be applied to mitigate the issue.
AI Analysis
Technical Summary
The Linux kernel's ksmbd_auth_ntlmv2() function derived the NTLMv2 session key into sess->sess_key before verifying the NTLMv2 response. If the authentication failed, ksmbd_decode_ntlmssp_auth_blob() still proceeded into the KEY_XCH arc4 encryption step, allowing a client to send a binding session setup with an invalid NT proof and still modify the session key before the STATUS_LOGON_FAILURE was returned. This vulnerability affects SMB3 multichannel binding sessions where the session setup error path does not expire binding sessions, potentially allowing unauthorized session key modification. The issue has been resolved in Linux kernel updates.
Potential Impact
An attacker could exploit this vulnerability to modify the session key in an SMB3 multichannel binding session without proper authentication, potentially leading to unauthorized actions on an existing session. The CVSS score of 8.2 indicates a high impact on integrity and availability, but no confidentiality impact was noted. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available and should be applied by updating to the fixed Linux kernel versions as specified in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions carefully to ensure full remediation.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2()… (CVE-2026-64389)
Description
A vulnerability in the Linux kernel's ksmbd component allowed an NTLMv2 response to be used to update a session key before proper validation, potentially enabling unauthorized modification of session keys during SMB3 multichannel binding. This flaw was addressed in Linux kernel updates. The vulnerability has a CVSS score of 8.2 and is considered medium severity. Multiple Linux kernel versions prior to 7.0.0-31.31 and related builds are affected. A patch is available and should be applied to mitigate the issue.
CVSS v3.1
Score 8.2high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ksmbd_auth_ntlmv2() function derived the NTLMv2 session key into sess->sess_key before verifying the NTLMv2 response. If the authentication failed, ksmbd_decode_ntlmssp_auth_blob() still proceeded into the KEY_XCH arc4 encryption step, allowing a client to send a binding session setup with an invalid NT proof and still modify the session key before the STATUS_LOGON_FAILURE was returned. This vulnerability affects SMB3 multichannel binding sessions where the session setup error path does not expire binding sessions, potentially allowing unauthorized session key modification. The issue has been resolved in Linux kernel updates.
Potential Impact
An attacker could exploit this vulnerability to modify the session key in an SMB3 multichannel binding session without proper authentication, potentially leading to unauthorized actions on an existing session. The CVSS score of 8.2 indicates a high impact on integrity and availability, but no confidentiality impact was noted. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available and should be applied by updating to the fixed Linux kernel versions as specified in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions carefully to ensure full remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fxvf-vm38-6pxw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64389"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420b9c2644c7f8084755
Added to database: 07/25/2026, 23:08:59 UTC
Last enriched: 09/07/2026, 18:02:28 UTC
Last updated: 09/08/2026, 10:52:11 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.