CVE-2026-68130 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: defer destroy_previous_session() until after NTLM authentication
In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM.
Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the linux kernel's ksmbd implementation, specifically affecting the ntlm authentication process. The flaw manifests as a race condition and privilege escalation opportunity that occurs during the NTLM authentication workflow. When processing NTLM authentication requests, the system calls destroy_previous_session() function before validating the NTLMv2 response, creating a window where malicious actors can exploit this timing issue to disrupt legitimate user sessions.
The technical implementation flaw stems from improper ordering of operations within the ntlm_authenticate() function. The system resolves a user pointer from the client-supplied NTLM blob username field and immediately invokes destroy_previous_session() using this pre-authentication lookup result, without first validating whether the subsequent NTLMv2 response is legitimate. This design pattern creates a scenario where an authenticated attacker can manipulate the authentication flow by setting the NTLM blob username to match a victim account while simultaneously setting PreviousSessionId to the victim's actual session ID.
The operational impact of this vulnerability allows for session hijacking and denial-of-service attacks against legitimate users. An attacker who has achieved initial authentication access can exploit this flaw to terminate active sessions belonging to other users, effectively causing disruption to normal network operations and potentially leading to unauthorized access through session manipulation. This particular vulnerability aligns with CWE-367, representing a time-of-check to time-of-use race condition that permits unauthorized resource manipulation.
The security implications extend beyond simple session termination, as this flaw enables attackers to potentially gain elevated privileges by disrupting legitimate authentication flows. The vulnerability specifically affects the SMB/CIFS server implementation within the linux kernel, where ksmbd handles network file sharing operations and authentication processes for remote clients. This creates a pathway for malicious actors to disrupt service availability while potentially gaining insight into legitimate user sessions and authentication patterns.
The mitigation strategy involves reordering the authentication process to ensure that destroy_previous_session() is only called after successful validation of the NTLMv2 response through ksmbd_decode_ntlmssp_auth_blob(). This approach mirrors the existing implementation pattern used in krb5_authenticate(), which properly validates authentication before destroying previous sessions. The fix requires moving the prev_id assignment and destroy_previous_session() calls to occur after the blob decoding function returns successfully, using sess->user instead of the pre-authentication lookup result to maintain proper session state management.
This vulnerability demonstrates a classic security anti-pattern where premature resource cleanup occurs before validation steps complete. The fix addresses the core issue by implementing proper authentication flow ordering that prevents unauthorized session destruction while maintaining legitimate session management functionality. This change ensures that only properly authenticated users can trigger session termination events, preventing the exploitation scenario where attackers manipulate the authentication process to target other users' sessions. The solution follows established security principles for session management and authentication flow control, aligning with industry best practices for preventing race conditions in authentication systems.
The vulnerability resolution addresses fundamental security concerns related to session management and authentication flow integrity within network services. By ensuring proper ordering of operations and validation steps before resource cleanup occurs, the fix prevents malicious actors from exploiting timing windows to disrupt legitimate user sessions. This correction maintains the system's integrity while preserving legitimate functionality for authorized users accessing shared network resources through SMB/CIFS protocols. The implementation change specifically targets the ATT&CK technique T1566 related to credential access and session hijacking, providing a robust defense against such exploitation methods.