Re: [PATCH] ksmbd: fix channel_key buffer overflow in multichannel binding

[Namjae Jeon]

On Mon, Jul 13, 2026 at 5:21 AM Junye Ji via B4 Relay
<devnull+jijunye1.outlook.com@xxxxxxxxxx> wrote:
>
> From: Junye Ji <jijunye1@xxxxxxxxxxx>
>
> ksmbd_decode_ntlmssp_auth_blob() and ksmbd_krb5_authenticate() can write
> keys up to CIFS_KEY_SIZE. During SMB3 multichannel binding, their
> destination is the 16-byte channel_key stack buffer, so longer keys
> overwrite the stack.
>
> Size the temporary buffers for the accepted maximum.
> register_session_channel() still stores a 16-byte channel key.
>
> I reproduced the stack write with 17- and 40-byte NTLM keys and a
> 32-byte Kerberos subkey. On the fixed KASAN kernel, 16-, 17-, and 40-byte
> NTLM keys and 16- and 32-byte Kerberos subkeys completed 10 bindings each
> without a report. The existing length check still rejected a 41-byte
> NTLM key.
>
> Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit")
> Assisted-by: Codex-Security:unspecified
> Signed-off-by: Junye Ji <jijunye1@xxxxxxxxxxx>
I have already applied the same patch that arrived before you.

https://github.com/smfrench/smb3-kernel/commit/578dc53f371ed19a8a9dc357af376a515f4c8ddb

Thanks.