CVE-2026-23364

ksmbd: Compare MACs in constant time

State: Published
Severity: 7.4 High
Published: Mar 25, 2026
Updated: Oct 15, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: Compare MACs in constant time

To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq().

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 8a665d733940592e671ec6afadcd0be80a091a80Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before cd52a0e309659537048a864211abc3ea4c5caa63Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 307afccb751f542246bd5dc68a2c1ffe1a78418cAffected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 2cdc56ed67615ba0921383a688f24415ebe065f3Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 93c0a22fec914ec4b697e464895a0f594e29fb28Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before f4588b85efd6007d46b80aa1b9fb746628ffb3dcAffected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before c5794709bc9105935dbedef8b9cf9c06f2b559faAffected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.210 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.19 through 6.18.Not affected 6.19.7 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 8a665d733940592e671ec6afadcd0be80a091a80Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before cd52a0e309659537048a864211abc3ea4c5caa63Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 307afccb751f542246bd5dc68a2c1ffe1a78418cAffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 2cdc56ed67615ba0921383a688f24415ebe065f3Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 93c0a22fec914ec4b697e464895a0f594e29fb28Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before f4588b85efd6007d46b80aa1b9fb746628ffb3dcAffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before c5794709bc9105935dbedef8b9cf9c06f2b559faAffected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.210 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.19 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.