{"id":"CVE-2026-72044","summary":"ksmbd: fix stack buffer overflow in multichannel session-key copy","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix stack buffer overflow in multichannel session-key copy\n\nCommit 4b706360ffb7 (\"ksmbd: fix multichannel binding and enforce channel\nlimit\") moved the binding-path session key out of the session-wide\nsess-\u003esess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and\nsized both that buffer and the on-stack copy used during binding with\nSMB2_NTLMV2_SESSKEY_SIZE (16):\n\n\tstruct channel {\n\t\tchar\tsess_key[SMB2_NTLMV2_SESSKEY_SIZE];\t/* 16 */\n\t\t...\n\t};\n\n\tntlm_authenticate() / krb5_authenticate():\n\t\tchar channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};\t/* 16 */\n\t\tchar *auth_key = conn-\u003ebinding ? channel_key : sess-\u003esess_key;\n\nThe two writers that fill this destination still bound the copy length\nagainst CIFS_KEY_SIZE (40), not against the 16-byte buffer:\n\n\tksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange):\n\t\tif (sess_key_len \u003e CIFS_KEY_SIZE)\t/* 40 */\n\t\t\treturn -EINVAL;\n\t\tarc4_crypt(ctx_arc4, sess_key,\n\t\t\t   (char *)authblob + sess_key_off, sess_key_len);\n\n\tksmbd_krb5_authenticate():\n\t\tif (resp-\u003esession_key_len \u003e sizeof(sess-\u003esess_key))\t/* 40 */\n\t\t\t...\n\t\tmemcpy(sess_key, resp-\u003epayload, resp-\u003esession_key_len);\n\nOn a binding SESSION_SETUP, auth_key points at the 16-byte channel_key,\nso a client that supplies an NTLM EncryptedRandomSessionKey of up to 40\nbytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose\nsession key is longer than 16 bytes (a normal AES256 key is 32), writes\npast the 16-byte stack buffer -- up to a 24-byte kernel stack overflow.\nKASAN reports it as a stack-out-of-bounds write in arc4_crypt() called\nfrom ksmbd_decode_ntlmssp_auth_blob().\n\nThe destinations must be able to hold the full session key the length\nchecks already permit. Size the per-channel key buffer and the two\non-stack channel_key buffers with CIFS_KEY_SIZE, matching sess-\u003esess_key.","modified":"2026-08-18T03:30:59.929377784Z","published":"2026-08-15T05:52:03.280Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72044.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/610346149d047a52a92c9a0eb329dd565b8f92c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9a7f7b55d7d0fbc4662c981ee6c56e081fa66d58"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72044.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72044"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a1f2ada2e4d33d316939dedefbfd2e7d94a0c61f"},{"fixed":"9a7f7b55d7d0fbc4662c981ee6c56e081fa66d58"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4b706360ffb7e459cb3d3edae30b06a584f6eddd"},{"fixed":"610346149d047a52a92c9a0eb329dd565b8f92c5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72044.json"}}],"schema_version":"1.9.0"}