Cloudanix VulnDB

CVE-2026-23364

High · 7.4

CVSS

7.4

EPSS

0.4%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the system checks secret codes for file sharing could let attackers guess the codes by timing responses, risking unauthorized access to shared files.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Exposure
Component
OS kernel
Class
Cryptographic Weakness
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows timing side-channel attacks against MAC verification in ksmbd by using a non-constant-time comparison function, potentially leaking authentication material.

Why it matters to the business

Attackers may be able to bypass SMB authentication or decrypt sessions, leading to unauthorized access to file shares and potential data breaches on systems using the Linux kernel SMB server.

How an attack unfolds

An attacker sends crafted authentication or signing requests to the ksmbd server and measures response times to infer the correct MAC value byte by byte, bypassing the need for brute force.

How to fix it

Update the Linux kernel to a version containing the fix that replaces memcmp with crypto_memneq in ksmbd MAC handling.

How to confirm the fix worked

Verify kernel source or binary contains the crypto_memneq call for MAC comparisons; test for constant-time behavior in MAC verification.

Typical attack path

  1. Identify ksmbd-enabled SMB server
  2. Send multiple authentication attempts with varying MAC values
  3. Measure timing differences in responses
  4. Reconstruct valid MAC through side-channel analysis
  5. Forge authenticated SMB messages

How to detect it

Look for repeated SMB authentication attempts from the same source with varying signatures in server logs; analyze timing patterns in authentication responses.

What your security team should do

  • Prioritize kernel updates on all systems running ksmbd
  • Disable ksmbd if SMB server functionality is not required
  • Monitor for unusual SMB authentication patterns

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq().

Affected packages

Ecosystem Package Introduced Fixed