{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "a1f2ada2e4d33d316939dedefbfd2e7d94a0c61f"
            },
            {
              "fixed": "9a7f7b55d7d0fbc4662c981ee6c56e081fa66d58"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4b706360ffb7e459cb3d3edae30b06a584f6eddd"
            },
            {
              "fixed": "610346149d047a52a92c9a0eb329dd565b8f92c5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72044.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix stack buffer overflow in multichannel session-key copy\n\nCommit 4b706360ffb7 (\"ksmbd: fix multichannel binding and enforce channel\nlimit\") moved the binding-path session key out of the session-wide\nsess-\u003esess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and\nsized both that buffer and the on-stack copy used during binding with\nSMB2_NTLMV2_SESSKEY_SIZE (16):\n\n\tstruct channel {\n\t\tchar\tsess_key[SMB2_NTLMV2_SESSKEY_SIZE];\t/* 16 */\n\t\t...\n\t};\n\n\tntlm_authenticate() / krb5_authenticate():\n\t\tchar channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};\t/* 16 */\n\t\tchar *auth_key = conn-\u003ebinding ? channel_key : sess-\u003esess_key;\n\nThe two writers that fill this destination still bound the copy length\nagainst CIFS_KEY_SIZE (40), not against the 16-byte buffer:\n\n\tksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange):\n\t\tif (sess_key_len \u003e CIFS_KEY_SIZE)\t/* 40 */\n\t\t\treturn -EINVAL;\n\t\tarc4_crypt(ctx_arc4, sess_key,\n\t\t\t   (char *)authblob + sess_key_off, sess_key_len);\n\n\tksmbd_krb5_authenticate():\n\t\tif (resp-\u003esession_key_len \u003e sizeof(sess-\u003esess_key))\t/* 40 */\n\t\t\t...\n\t\tmemcpy(sess_key, resp-\u003epayload, resp-\u003esession_key_len);\n\nOn a binding SESSION_SETUP, auth_key points at the 16-byte channel_key,\nso a client that supplies an NTLM EncryptedRandomSessionKey of up to 40\nbytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose\nsession key is longer than 16 bytes (a normal AES256 key is 32), writes\npast the 16-byte stack buffer -- up to a 24-byte kernel stack overflow.\nKASAN reports it as a stack-out-of-bounds write in arc4_crypt() called\nfrom ksmbd_decode_ntlmssp_auth_blob().\n\nThe destinations must be able to hold the full session key the length\nchecks already permit. Size the per-channel key buffer and the two\non-stack channel_key buffers with CIFS_KEY_SIZE, matching sess-\u003esess_key.",
  "id": "CVE-2026-72044",
  "modified": "2026-08-18T03:30:59.929377784Z",
  "published": "2026-08-15T05:52:03.280Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/610346149d047a52a92c9a0eb329dd565b8f92c5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9a7f7b55d7d0fbc4662c981ee6c56e081fa66d58"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72044.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72044"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "ksmbd: fix stack buffer overflow in multichannel session-key copy"
}