CVE-2026-64389

kernel: ksmbd: validate NTLMv2 response before updating session key

Loading…

Severity

Important

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · July 25, 2026

Updated · October 20, 2026

Description

A flaw was found in the Linux kernel's ksmbd component. A remote attacker could exploit a vulnerability in the NTLMv2 authentication process to modify a session key even when authentication fails. This bypasses security checks and could potentially lead to unauthorized access or session hijacking.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-179 · Incorrect Behavior Order: Early Validation