The Linux kernel’s smb server (ksmbd) writes the NTLMv2 session key before confirming that the client’s NTLMv2 response is valid. When authentication fails, the code still proceeds to exchange the key using KEY_XCH, allowing the client to carry a malformed proof, keep an invalid session key and receive a failure status, but still influence server state. This flaw effectively lets an attacker modify the session key during an attempted binding, potentially enabling unauthorized access or privilege escalation within the SMB session.

All Linux kernel deployments that include the ksmbd component with SMB3 multichannel binding may be affected. No specific kernel version range is provided in the data, so any kernel build containing ksmbd that has not been updated to the fix is potentially vulnerable.

The flaw offers remote authentication bypass over SMB, with a CVSS score of 8.2. The EPSS score is below 1 %, indicating a very low current exploitation probability, and the issue is not yet present in the CISA KEV catalog. Nevertheless, because the vulnerability can be triggered over the network by any SMB client, its potential impact is high for systems that host untrusted SMB connections. Exploitability requires only SMB3 multichannel negotiation and the ability to send a binding session setup with a bad NT proof, making it an out‑of‑band network attack when the kernel is reachable.