CVE-2026-68130

A flaw was found in ksmbd, a kernel module for SMB3 protocol server in the Linux kernel. An authenticated attacker can exploit a vulnerability in the NTLM (NT LAN Manager) authentication process. By manipulating specific fields in the NTLM authentication blob, an attacker can cause a victim's session to be prematurely terminated, leading to a denial of service for the affected user.

This issue affects ksmbd with NTLM authentication. destroy_previous_session() runs before NTLMv2 validation using a client-controlled username, allowing session disruption of other users. Requires ksmbd with NTLM and authenticated access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.