{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ksmbd: validate NTLMv2 response before updating session key  ksmbd_auth_ntlmv2() derives the NTLMv2 session key into sess-\u003esess_key before it verifies the NTLMv2 response. ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even when ksmbd_auth_ntlmv2() failed.  With SMB3 multichannel binding, the failed authentication operates on an existing session and the session setup error path does not expire binding sessions. A client can send a binding session setup with a bad NT proof and KEY_XCH and still modify sess-\u003esess_key before STATUS_LOGON_FAILURE is returned.  Relevant path:    smb2_sess_setup()     -\u003e conn-\u003ebinding = true     -\u003e ntlm_authenticate()        -\u003e session_user()        -\u003e ksmbd_decode_ntlmssp_auth_blob()           -\u003e ksmbd_auth_ntlmv2()              -\u003e calc_ntlmv2_hash()              -\u003e hmac_md5_usingrawkey(..., sess-\u003esess_key)              -\u003e crypto_memneq() returns mismatch           -\u003e KEY_XCH arc4_crypt(..., sess-\u003esess_key, ...)     -\u003e out_err without expiring the binding session  Derive the base session key into a local buffer and copy it to sess-\u003esess_key only after the proof matches. Return immediately on authentication failure so KEY_XCH is only processed after successful authentication.",
  "id": "DEBIAN-CVE-2026-64389",
  "modified": "2026-09-14T16:47:46.735049226Z",
  "published": "2026-07-25T10:17:22.227Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64389"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64389"
  ]
}