From: Junye Ji <jijunye1@outlook.com>

ksmbd_decode_ntlmssp_auth_blob() and ksmbd_krb5_authenticate() can write
keys up to CIFS_KEY_SIZE. During SMB3 multichannel binding, their
destination is the 16-byte channel_key stack buffer, so longer keys
overwrite the stack.

Size the temporary buffers for the accepted maximum.
register_session_channel() still stores a 16-byte channel key.

I reproduced the stack write with 17- and 40-byte NTLM keys and a
32-byte Kerberos subkey. On the fixed KASAN kernel, 16-, 17-, and 40-byte
NTLM keys and 16- and 32-byte Kerberos subkeys completed 10 bindings each
without a report. The existing length check still rejected a 41-byte
NTLM key.

Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit")
Assisted-by: Codex-Security:unspecified
Signed-off-by: Junye Ji <jijunye1@outlook.com>
---
I can send the reproducers and full KASAN logs privately if needed.
---
 fs/smb/server/smb2pdu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index b73167785e87..d8a7db655043 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1689,7 +1689,7 @@ static int ntlm_authenticate(struct ksmbd_work *work,
 	struct ksmbd_conn *conn = work->conn;
 	struct ksmbd_session *sess = work->sess;
 	struct ksmbd_user *user;
-	char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};
+	char channel_key[CIFS_KEY_SIZE] = {};
 	char *auth_key = conn->binding ? channel_key : sess->sess_key;
 	u64 prev_id;
 	bool binding = conn->binding;
@@ -1826,7 +1826,7 @@ static int krb5_authenticate(struct ksmbd_work *work,
 	struct ksmbd_conn *conn = work->conn;
 	struct ksmbd_session *sess = work->sess;
 	char *in_blob, *out_blob;
-	char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {};
+	char channel_key[CIFS_KEY_SIZE] = {};
 	char *auth_key = conn->binding ? channel_key : sess->sess_key;
 	u64 prev_sess_id;
 	bool binding = conn->binding;

---
base-commit: 44696aa3a489d2baf58efa61b37833f100072bee
change-id: 20260712-ksmbd-channel-key-size-3aac1be670da

Best regards,
-- 
Junye Ji <jijunye1@outlook.com>

On Mon, Jul 13, 2026 at 5:21 AM Junye Ji via B4 Relay
<devnull+jijunye1.outlook.com@kernel.org> wrote:
>
> From: Junye Ji <jijunye1@outlook.com>
>
> ksmbd_decode_ntlmssp_auth_blob() and ksmbd_krb5_authenticate() can write
> keys up to CIFS_KEY_SIZE. During SMB3 multichannel binding, their
> destination is the 16-byte channel_key stack buffer, so longer keys
> overwrite the stack.
>
> Size the temporary buffers for the accepted maximum.
> register_session_channel() still stores a 16-byte channel key.
>
> I reproduced the stack write with 17- and 40-byte NTLM keys and a
> 32-byte Kerberos subkey. On the fixed KASAN kernel, 16-, 17-, and 40-byte
> NTLM keys and 16- and 32-byte Kerberos subkeys completed 10 bindings each
> without a report. The existing length check still rejected a 41-byte
> NTLM key.
>
> Fixes: 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit")
> Assisted-by: Codex-Security:unspecified
> Signed-off-by: Junye Ji <jijunye1@outlook.com>
I have already applied the same patch that arrived before you.

https://github.com/smfrench/smb3-kernel/commit/578dc53f371ed19a8a9dc357af376a515f4c8ddb

Thanks.