CVE-2026-68130

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: defer destroyprevioussession() until after NTLM authentication

In ntlmauthenticate(), destroyprevioussession() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroyprevioussession() destroys the victim's session while ksmbddecodentlmsspauth_blob() subsequently rejects the request with -EPERM.

Move destroyprevioussession() and the previd assignment to after ksmbddecodentlmsspauthblob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5authenticate(), where destroyprevioussession() is called only after ksmbdkrb5authenticate() returns success.