01 Record

CVE-2026-64389

ksmbd: validate NTLMv2 response before updating session key

HighPUBLISHEDCNA: Linux

CNA base score8.2 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

View raw JSON

02 Description

ksmbd: validate NTLMv2 response before updating session key

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.46% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 40.2% of scored records. A rank, not a probability.
NVD base score: 8.2 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-10-21.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-25 08:50Z3 MO AGO

Last updated

2026-10-21 12:43Z8 DAYS AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.2)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses

CWE-179Incorrect Behavior Order: Early ValidationBase

Data version

5.2

Document digest

9342110a8093b0f06e25187d77c8994f7b5b0853cae823e1de4bb5d9ade362de

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < a6a951416b55eaf51ea2742f7ba786f240e70137, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < f5d74c186bab26a5d5a025305e67edd0888aa34d, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < b56400364aed5c34d6e1a0b493081290a5328a9c, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 89ca7756d5566ba636bb9092cdbe57dab095e136, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 954d196bebb2b50151cb96454c72dc113b2af1ac, 5.15—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/a6a951416b55eaf51ea2742f7ba786f240e70137
git.kernel.orghttps://git.kernel.org/stable/c/f5d74c186bab26a5d5a025305e67edd0888aa34d
git.kernel.orghttps://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c
git.kernel.orghttps://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136
git.kernel.orghttps://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac

07 Fixed in

Debian 12

linux
No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.