CVE-2026-23364: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-23364 is a timing-based MAC comparison vulnerability in the Linux kernel's ksmbd (in-kernel SMB server) component. The flaw arises because MAC (Message Authentication Code) comparisons use the non-constant-time memcmp() function instead of the cryptographically safe crypto_memneq(), making the comparisons susceptible to timing side-channel attacks. Affected kernel versions include 5.15.1 through 6.1.166, 6.2 through 6.6.129, 6.7 through 6.12.77, 6.13 through 6.18.18, 6.19 through 6.19.6, and 7.0-rc1/rc3–rc7. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 7.4 (High) (Red Hat CVE, Microsoft MSRC).

The root cause is classified as CWE-208 (Observable Timing Discrepancy). In the ksmbd SMB server implementation, MAC values used for SMB message authentication are compared using memcmp(), which short-circuits on the first differing byte and thus leaks timing information proportional to how many leading bytes match. An unauthenticated network attacker can exploit this by sending crafted SMB authentication requests and measuring response times to recover MAC values byte-by-byte, effectively forging authentication credentials. No user interaction is required, but exploitation demands high attack complexity due to the precision of timing measurements needed. The fix replaces memcmp() with crypto_memneq(), which performs comparisons in constant time regardless of input (Red Hat CVE, Kernel Patch).

Successful exploitation could allow a network-adjacent attacker to forge SMB authentication credentials by recovering MAC values through timing analysis, leading to unauthorized access to SMB shares and confidential data. Both confidentiality and integrity are rated HIGH impact, as an attacker who bypasses authentication could read sensitive files and potentially modify data on exposed SMB services. Availability is not directly impacted. Systems running ksmbd as an SMB server and exposed to untrusted networks are at greatest risk, with potential for lateral movement within environments relying on SMB for file sharing (Red Hat CVE, Microsoft MSRC).

1. Reconnaissance: Identify hosts running the Linux kernel ksmbd SMB server on vulnerable kernel versions (5.15.1–6.1.166, 6.2–6.6.129, 6.7–6.12.77, 6.13–6.18.18, 6.19–6.19.6, 7.0-rc1/rc3–rc7) using network scanners such as Nmap targeting TCP port 445.
2. Establish network proximity: Position the attacker on a low-latency network path to the target to minimize timing noise, ideally on the same LAN segment or with a stable, low-jitter connection.
3. Send crafted SMB authentication requests: Initiate SMB authentication sessions to the ksmbd service, submitting authentication messages with systematically varied MAC values (e.g., iterating candidate bytes at each position).
4. Measure response timing: Record the precise response time for each crafted request. Because memcmp() returns early on the first mismatched byte, a slightly longer response time indicates a correct byte at the current position.
5. Recover MAC byte-by-byte: Repeat the process for each byte position of the MAC, using statistical analysis across many samples to distinguish timing differences from noise.
6. Forge authentication: Assemble the recovered MAC value to construct a valid authentication message, bypassing the SMB authentication check and gaining unauthorized access to the SMB server's resources (Red Hat CVE, Microsoft MSRC).

• Network: High volume of SMB authentication attempts (TCP port 445) from a single source IP, particularly with repeated sessions that differ only in the MAC/signature field of authentication messages; unusual patterns of rapid, repeated SMB session establishment and teardown.
• Logs: Kernel or SMB server logs showing a large number of authentication failures from the same source IP in a short time window; ksmbd debug logs (if enabled) showing repeated MAC verification failures with incrementally varying inputs.
• Process/System: Unexpected ksmbd process activity or elevated CPU usage on the SMB server correlating with bursts of inbound SMB connections from an unfamiliar host.
• Network: Successful SMB authentication from an IP or account that has no prior legitimate access history, following a period of high-volume failed authentication attempts from the same source.

Apply the available kernel updates containing the fix (replacing memcmp() with crypto_memneq() in ksmbd MAC comparison). Fixed versions are: 6.1.167 or later (6.1.x branch), 6.6.130 or later (6.2–6.6.x branch), 6.12.78 or later (6.7–6.12.x branch), 6.18.19 or later (6.13–6.18.x branch), 6.19.7 or later (6.19.x branch), and 7.0-rc2 or later. Multiple upstream kernel commits are available at git.kernel.org. For systems that cannot be patched immediately, disable or restrict network access to the ksmbd SMB service (TCP port 445) using firewall rules, or limit SMB exposure to trusted network segments only (Red Hat CVE, Microsoft MSRC).

Red Hat and Microsoft both tracked and published advisories for this vulnerability shortly after its disclosure in March 2026. Debian issued security updates (DSA and LTS advisories) addressing this CVE in the linux package, and the Yocto Project security mailing list also flagged it for embedded Linux users. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor and distribution tracking.