Timing Attack Vulnerability in Linux Kernel's ksmbd Component

CVE-2026-23364

What is CVE-2026-23364?

A vulnerability has been identified in the Linux kernel's ksmbd component related to MAC comparisons, which could allow for timing attacks. To mitigate this risk, the implementation has been updated to replace the standard memcmp() function with the more secure crypto_memneq(). This change ensures that MAC comparisons occur in constant time, preventing potential attackers from exploiting timing differences to gain unauthorized access to sensitive data.

References