Re: [PATCH] ksmbd: refuse reauthentication of an expired session as another user

[Namjae Jeon]

On Tue, Nov 10, 2026 at 4:58 AM Michail Andreas Michalopoulos
<mike.michalo@xxxxxxxxx> wrote:
>
> When a Kerberos session expires, its owner can reauthenticate it. For an
> NTLM reauthentication, ntlm_authenticate() only compares the new user with
> sess->user when the session is still valid. An expired session is in
> SMB2_SESSION_IN_PROGRESS during the reauthentication, so it takes the
> other branch and simply sets sess->user to the new user:
>
> - the session's open files, tree connects and other state, created under
>   the original user's identity, now belong to whichever user just
>   authenticated, and a later Kerberos reauthentication is compared
>   against that user rather than the original one;
> - the original struct ksmbd_user is overwritten without being freed.
>
> krb5_authenticate() already refuses a different user in this case, and
> the valid-session branch of ntlm_authenticate() does too. Do the same for
> an expired session: compare with the existing user and refuse a different
> one with -EKEYREJECTED, freeing the newly looked-up user either way.
>
> An AI assistant was used to find and fix this and as an independent
> reviewer.
>
> Fixes: a47634cd729b ("ksmbd: expire SMB sessions when Kerberos tickets expire")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@xxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!