CVE-2026-74521 (GCVE-0-2026-74521)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-03 10:56
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal. Use memcmp() in SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE bytes.
References
Impacted products
Vendor Product Version
Linux Linux Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Version: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7bde6f181fa307d2cc1ec2b0313ac8e9811c8232",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "5a0367bf5ce420be7b19936def2e90adcf32a683",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "ba2a5b66f1d414eb8403d655f8813783892cfc85",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "a386c83043015a703e227775f778e40343f45911",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "d535363299822c5caa543787b21bd5cfa3e41949",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "e8bb506e6ef749ac0336f3e579d8d02396b7d832",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use memcmp() to compare ClientGUIDs\n\nClientGUID is a fixed-size binary value and can contain embedded NUL\nbytes. strncmp() stops comparing at the first NUL byte, so different\nClientGUID values can incorrectly be treated as equal.\n\nUse memcmp() in SMB3 multichannel session binding and\nFSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE\nbytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd\u0027s in-kernel SMB server on TCP/445; vulnerable ClientGUID comparisons run while handling remotely supplied SMB2 SESSION_SETUP multichannel binding and SMB2 IOCTL FSCTL_VALIDATE_NEGOTIATE_INFO requests from any network peer.\nAC:L - The attacker controls negotiate ClientGUID bytes (including embedded NULs), can open many TCP connections, brute-force sequential session IDs, and repeatedly attempt binding until strncmp accepts a prefix-colliding GUID without conditions outside attacker control.\nPR:N - Multichannel SESSION_SETUP binding is processed before the attacker authenticates; once a victim SMB2_SESSION_VALID session is targeted, ntlm_authenticate skips password verification on rebind, requiring only network reachability plus session ID and username guessing, not a valid server account.\nUI:N - Exploitation requires no victim interaction such as opening files, mounting shares, or clicking links; the attacker drives negotiate, binding, and IOCTL requests directly against the exposed SMB service.\nS:U - Successful exploitation grants unauthorized use of an existing SMB session and its exported share access within ksmbd\u0027s authority, not crossing into another security domain such as host kernel privilege or VM escape.\nC:H - Bypassing ClientGUID verification enables hijacking another client\u0027s authenticated SMB3 multichannel session, providing read access to all files, directories, and metadata that victim session may access on server exports.\nI:H - A fraudulently bound channel receives the victim session\u0027s channel signing keys and full SMB operation rights, allowing arbitrary create, write, modify, and delete of files and objects permitted to that hijacked session.\nA:N - This is a logical string-comparison flaw causing incorrect authorization decisions, not memory corruption or a crash primitive; exploitation does not inherently panic, oops, or deny kernel or ksmbd availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:56:04.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7bde6f181fa307d2cc1ec2b0313ac8e9811c8232"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a0367bf5ce420be7b19936def2e90adcf32a683"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba2a5b66f1d414eb8403d655f8813783892cfc85"
        },
        {
          "url": "https://git.kernel.org/stable/c/a386c83043015a703e227775f778e40343f45911"
        },
        {
          "url": "https://git.kernel.org/stable/c/d535363299822c5caa543787b21bd5cfa3e41949"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"
        }
      ],
      "title": "ksmbd: use memcmp() to compare ClientGUIDs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74521",
    "datePublished": "2026-08-15T12:27:39.330Z",
    "dateReserved": "2026-08-15T05:44:03.911Z",
    "dateUpdated": "2026-10-03T10:56:04.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.