IBM Support

Linux mounts and Windows OS's using NTLMv1 fail to IBM i Netserver shares after applying latest CVE PTFs from Aug 2026.

Question & Answer


Question

After applying the following PTFs Linux based systems can fail to mount to CIFS Shares on the IBM i, IE: mount.cifs

Attempting to mount to Netserver shares defined on the IBM i fails after applying the following PTFs:

Available 08/13/2026

MJ10936 5770999 V7R3M0 
MJ10937 5770999 V7R4M0 
MJ10938 5770999 V7R5M0 
MJ10939 5770999 V7R6M0 

CVE's covered in the above PTFs:
CVE-2026-16858
CVE-2026-16867
CVE-2026-16868
CVE-2026-16853
CVE-2026-17226
CVE-2026-16859
CVE-2026-16878
CVE-2026-16861
CVE-2026-17212
CVE-2026-18020
CVE-2026-17649
CVE-2026-16871
CVE-2026-18671
CVE-2026-18680
CVE-2026-17502

 

Cause

IBM i Netserver forces verification of the NTLMSSP message integrity code to strengthen security and prevent man in the middle attacks after applying PTFs.

Answer

The NT LAN Manager Security Support Provider (NTLMSSP) provides a message integrity code (MIC) of client/server communication during connection negotiation.  The MIC is an important security feature to help prevent a man-in-the-middle from inserting himself in the conversation and forcing the client to negotiate weaker security settings than it normally would.  A man-in-the middle could strip the NTLMSSP message content to remove the integrity code.

IBM i NetServer forces verification of the NTLMSSP message integrity code by default.  This improves security but breaks clients that send NTLMSSP authentication data without the message integrity code.  The Linux mount.cifs file system is known to send NTLMSSP in this manner.

System administrators can choose to make the NTLMSSP integrity code optional by using the following command to set a NetServer configuration flag.
 

Note: Prior to running the call end Netserver:
ENDTCPSVR *NETSVR

The bitmask 0x20000 will not impact previously set bits for SMB versions.


CALL QZLSMAINT PARM('40' '1' '0x20000')

If the circumvention is no longer needed, the default can be restored by calling the following command.

CALL QZLSMAINT PARM('40' '2' '0x20000')

[{"Type":"MASTER","Line of Business":{"code":"LOB68","label":"Power HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CLSAA2","label":"Integrated File System-\u003ENetServer"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.3.0;7.4.0;7.5.0;7.6.0"}]

Document Information

Modified date:
31 August 2026

UID

ibm17283343

Page Feedback