CVE-2026-23364

Vulnerability

CVE-2026-23364 is a timing side-channel vulnerability in the Linux kernel's ksmbd (SMB/CIFS) server. The root cause is that the Message Authentication Code (MAC) comparison in ksmbd uses memcmp(), which is not constant-time. This allows an attacker to infer the correct MAC byte-by-byte by measuring response times, potentially leading to signature forgery [1] signature forgery.

Exploitation

An attacker with network access to a ksmbd server can send crafted SMB requests and observe the timing of authentication responses. No prior authentication is required, as the vulnerability exists in the MAC verification step during session setup. By repeatedly sending requests and measuring response times, the attacker can recover the correct MAC value [1].

Impact

Successful exploitation enables the attacker to forge valid SMB signatures, bypassing integrity checks. This could allow unauthorized access to shared files or impersonation of legitimate clients. The CVSS v3 score is 7.4 (High), reflecting the potential for significant confidentiality and integrity impact [1].

Mitigation

The fix replaces memcmp() with crypto_memneq(), which performs constant-time comparison, eliminating the timing side-channel. The patch has been applied to the Linux kernel stable branches [1][2][3][4]. Users should update their kernels to the latest patched versions.