Linux Kernel ksmbd CVE-2026-64389

Exploitation requires ksmbd to be actively running on the target Linux system (CONFIG_SMB_SERVER loaded and service started - not a default configuration on any mainstream Linux distribution). SMB3 multichannel must be enabled on the ksmbd server, as the vulnerable code path is only reached when conn->binding = true in smb2_sess_setup(). The attacker must be able to identify a valid existing SessionId to reference in the binding SESSION_SETUP request. No successful prior authentication is required for the malicious binding attempt itself (the bug is that auth failure does not prevent key modification). Limiting factors: ksmbd is niche and off by default; SMB3 multichannel is an additional non-default feature; session targeting requires SessionId knowledge; and the session key corruption may be self-limiting if the corrupted session is immediately terminated by the client.

The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (8.2) overstates the attack complexity. Exploitation requires two non-default conditions: (1) ksmbd must be running with SMB3 multichannel enabled, and (2) the attacker must target an existing authenticated session - the binding SESSION_SETUP only makes sense against a live session the attacker can reference. These prerequisites raise the realistic AC to High. PR:N is defensible because the malicious binding attempt itself does not require prior successful authentication (that is the bug being exploited), but real targeting of a session adds complexity. EPSS 0.25% at the 16th percentile aligns with a config-gated server-side race condition. No public exploit code and no KEV listing as of time of analysis. The primary impact is availability - corrupting a session key breaks an authenticated SMB3 session - with a secondary integrity concern from key substitution, which could theoretically weaken session encryption. This is a real but operationally bounded priority: deployments not running ksmbd, or not using SMB3 multichannel, are unaffected.

An attacker on the network sends a crafted SMB3 SESSION_SETUP request with conn->binding = true, targeting an existing authenticated session by its SessionId, supplying a deliberately invalid NTLMv2 NT proof alongside a malicious KEY_XCH blob. Because ksmbd writes the derived key before verifying the proof and does not expire the binding session on error, the arc4_crypt KEY_XCH operation overwrites sess->sess_key with attacker-controlled material before STATUS_LOGON_FAILURE is returned - the legitimate session's signing/encryption key is now corrupted, severing the session.