{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d535363299822c5caa543787b21bd5cfa3e41949",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "e8bb506e6ef749ac0336f3e579d8d02396b7d832",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use memcmp() to compare ClientGUIDs\n\nClientGUID is a fixed-size binary value and can contain embedded NUL\nbytes. strncmp() stops comparing at the first NUL byte, so different\nClientGUID values can incorrectly be treated as equal.\n\nUse memcmp() in SMB3 multichannel session binding and\nFSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE\nbytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd\u0027s in-kernel SMB server on TCP/445; vulnerable ClientGUID comparisons run while handling remotely supplied SMB2 SESSION_SETUP multichannel binding and SMB2 IOCTL FSCTL_VALIDATE_NEGOTIATE_INFO requests from any network peer.\nAC:L - The attacker controls negotiate ClientGUID bytes (including embedded NULs), can open many TCP connections, brute-force sequential session IDs, and repeatedly attempt binding until strncmp accepts a prefix-colliding GUID without conditions outside attacker control.\nPR:N - Multichannel SESSION_SETUP binding is processed before the attacker authenticates; once a victim SMB2_SESSION_VALID session is targeted, ntlm_authenticate skips password verification on rebind, requiring only network reachability plus session ID and username guessing, not a valid server account.\nUI:N - Exploitation requires no victim interaction such as opening files, mounting shares, or clicking links; the attacker drives negotiate, binding, and IOCTL requests directly against the exposed SMB service.\nS:U - Successful exploitation grants unauthorized use of an existing SMB session and its exported share access within ksmbd\u0027s authority, not crossing into another security domain such as host kernel privilege or VM escape.\nC:H - Bypassing ClientGUID verification enables hijacking another client\u0027s authenticated SMB3 multichannel session, providing read access to all files, directories, and metadata that victim session may access on server exports.\nI:H - A fraudulently bound channel receives the victim session\u0027s channel signing keys and full SMB operation rights, allowing arbitrary create, write, modify, and delete of files and objects permitted to that hijacked session.\nA:N - This is a logical string-comparison flaw causing incorrect authorization decisions, not memory corruption or a crash primitive; exploitation does not inherently panic, oops, or deny kernel or ksmbd availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:13.413Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d535363299822c5caa543787b21bd5cfa3e41949"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"
        }
      ],
      "title": "ksmbd: use memcmp() to compare ClientGUIDs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74521",
    "datePublished": "2026-08-15T12:27:39.330Z",
    "dateReserved": "2026-08-15T05:44:03.911Z",
    "dateUpdated": "2026-08-17T05:48:13.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}