CVE-2026-72044 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix stack buffer overflow in multichannel session-key copy
Commit 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit") moved the binding-path session key out of the session-wide sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and sized both that buffer and the on-stack copy used during binding with SMB2_NTLMV2_SESSKEY_SIZE (16):
struct channel {
char sess_key[SMB2_NTLMV2_SESSKEY_SIZE]; /* 16 */
... };
ntlm_authenticate() / krb5_authenticate(): char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; /* 16 */
char *auth_key = conn->binding ? channel_key : sess->sess_key;
The two writers that fill this destination still bound the copy length against CIFS_KEY_SIZE (40), not against the 16-byte buffer:
ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange): if (sess_key_len > CIFS_KEY_SIZE) /* 40 */ return -EINVAL; arc4_crypt(ctx_arc4, sess_key, (char *)authblob + sess_key_off, sess_key_len);
ksmbd_krb5_authenticate(): if (resp->session_key_len > sizeof(sess->sess_key)) /* 40 */ ... memcpy(sess_key, resp->payload, resp->session_key_len);
On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key, so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40 bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose session key is longer than 16 bytes (a normal AES256 key is 32), writes past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow. KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called from ksmbd_decode_ntlmssp_auth_blob().
The destinations must be able to hold the full session key the length checks already permit. Size the per-channel key buffer and the two on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the Linux kernel's ksmbd implementation, specifically within the SMB2 protocol handling layer where multichannel session management is implemented. This flaw represents a classic stack buffer overflow condition that arises from inconsistent buffer sizing and length validation logic during authentication processes. The issue stems from a code modification that introduced separate buffers for channel-specific session keys while failing to maintain consistent sizing across all related memory allocations, creating a scenario where attackers can exploit the mismatch to overwrite kernel stack memory.
The technical flaw manifests in two primary authentication pathways within the ksmbd subsystem: NTLM authentication and Kerberos authentication. During NTLM key exchange operations, the function ksmbd_decode_ntlmssp_auth_blob validates session key lengths against CIFS_KEY_SIZE (40 bytes) but writes data into a destination buffer that is only 16 bytes in size, defined as SMB2_NTLMV2_SESSKEY_SIZE. Similarly, in Kerberos authentication through ksmbd_krb5_authenticate, the system permits session key lengths up to the full sess->sess_key buffer size (40 bytes) while writing into a channel-specific stack buffer of only 16 bytes. This discrepancy creates a potential for kernel stack overflows of up to 24 bytes when attackers supply session keys that exceed the 16-byte channel buffer capacity.
The operational impact of this vulnerability is significant within environments that utilize SMB multichannel connections, particularly where ksmbd serves as the SMB server implementation. Attackers exploiting this weakness could potentially corrupt kernel stack memory, leading to unpredictable system behavior, denial of service conditions, or in worst-case scenarios, privilege escalation opportunities. The vulnerability affects both NTLM and Kerberos authentication mechanisms, making it broadly applicable across different authentication methods within the SMB protocol stack. The KASAN (Kernel Address Sanitizer) detection confirms the stack-out-of-bounds write condition occurring during arc4_crypt() operations, providing clear evidence of the memory corruption that occurs when session keys exceed the intended buffer boundaries.
This vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which specifically addresses buffer overflows where data written to stack buffers exceeds their allocated size. The issue also relates to ATT&CK technique T1068, which encompasses privilege escalation through exploitation of system vulnerabilities, particularly in kernel-mode components. The flaw demonstrates poor input validation and memory management practices within the kernel's security subsystem, where proper bounds checking was not consistently applied across all buffer allocation sizes. The fix requires aligning all session key buffer sizes to match CIFS_KEY_SIZE (40 bytes) throughout the authentication flow, ensuring that both per-channel buffers and stack-based channel_key allocations can accommodate the maximum permitted session key length.
The mitigation approach involves modifying the channel structure definition and authentication function declarations to use consistent buffer sizing throughout the codebase. All session key buffers must be sized to accommodate the full CIFS_KEY_SIZE of 40 bytes, eliminating the mismatch that enables the overflow condition. This correction ensures that when authentication functions process session keys up to the maximum permitted length, they have adequate buffer space to prevent stack corruption. The fix also reinforces proper memory management practices by ensuring that all validation checks and allocation sizes remain consistent, preventing similar issues from arising in future modifications to the authentication handling code.