---
id: CVE-2026-68130
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: defer destroy_previous_session() until after NTLM authentication

  In ntlm_authenticate(), destroy_previous_session() is called using a
  user pointer resolved from…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: defer destroy_previous_session() until after NTLM authentication

  In ntlm_authenticate(), destroy_previous_session() is called using a
  user pointer resolved from…
severity: none
published: '2026-08-10'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68130'
references:
  - url: 'https://git.kernel.org/stable/c/0ff12308c8a6c16ab68f0a487ffa93d69001dc18'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/18705cace0619fd2123737dcd028147774f38181'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/243f1614ef2aca2d62a744575f1c24b07cd42757'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/370b0ec8822b69c9073265e16b7daaa8201c9a4f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5c833074b549e5db125436a6f681af682261f785'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ab0230257ebdf48b07eaa679a8c92bc842fe3498'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c74801ee524f477c174a1899782b6c3b6918d407'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00257
epssPercentile: 0.15478
ingestedAt: '2026-08-23T13:48:06.117Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer destroy_previous_session() until after NTLM authentication

In ntlm_authenticate(), destroy_previous_session() is called using a
user pointer resolved from the client-supplied NTLM blob username field
before the NTLMv2 response is validated. An authenticated attacker can
set the NTLM blob username to match a victim account and set
PreviousSessionId to the victim's session ID; destroy_previous_session()
destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob()
subsequently rejects the request with -EPERM.

Move destroy_previous_session() and the prev_id assignment to after
ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user
rather than the pre-authentication lookup result. This matches the
ordering already used by krb5_authenticate(), where
destroy_previous_session() is called only after
ksmbd_krb5_authenticate() returns success.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.