GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74521 (GCVE-0-2026-74521)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-17 05:48
VLAI
Title
ksmbd: use memcmp() to compare ClientGUIDs
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal. Use memcmp() in SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE bytes.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < d535363299822c5caa543787b21bd5cfa3e41949 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < e8bb506e6ef749ac0336f3e579d8d02396b7d832 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d535363299822c5caa543787b21bd5cfa3e41949",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "e8bb506e6ef749ac0336f3e579d8d02396b7d832",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use memcmp() to compare ClientGUIDs\n\nClientGUID is a fixed-size binary value and can contain embedded NUL\nbytes. strncmp() stops comparing at the first NUL byte, so different\nClientGUID values can incorrectly be treated as equal.\n\nUse memcmp() in SMB3 multichannel session binding and\nFSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE\nbytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd\u0027s in-kernel SMB server on TCP/445; vulnerable ClientGUID comparisons run while handling remotely supplied SMB2 SESSION_SETUP multichannel binding and SMB2 IOCTL FSCTL_VALIDATE_NEGOTIATE_INFO requests from any network peer.\nAC:L - The attacker controls negotiate ClientGUID bytes (including embedded NULs), can open many TCP connections, brute-force sequential session IDs, and repeatedly attempt binding until strncmp accepts a prefix-colliding GUID without conditions outside attacker control.\nPR:N - Multichannel SESSION_SETUP binding is processed before the attacker authenticates; once a victim SMB2_SESSION_VALID session is targeted, ntlm_authenticate skips password verification on rebind, requiring only network reachability plus session ID and username guessing, not a valid server account.\nUI:N - Exploitation requires no victim interaction such as opening files, mounting shares, or clicking links; the attacker drives negotiate, binding, and IOCTL requests directly against the exposed SMB service.\nS:U - Successful exploitation grants unauthorized use of an existing SMB session and its exported share access within ksmbd\u0027s authority, not crossing into another security domain such as host kernel privilege or VM escape.\nC:H - Bypassing ClientGUID verification enables hijacking another client\u0027s authenticated SMB3 multichannel session, providing read access to all files, directories, and metadata that victim session may access on server exports.\nI:H - A fraudulently bound channel receives the victim session\u0027s channel signing keys and full SMB operation rights, allowing arbitrary create, write, modify, and delete of files and objects permitted to that hijacked session.\nA:N - This is a logical string-comparison flaw causing incorrect authorization decisions, not memory corruption or a crash primitive; exploitation does not inherently panic, oops, or deny kernel or ksmbd availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:13.413Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d535363299822c5caa543787b21bd5cfa3e41949"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"
        }
      ],
      "title": "ksmbd: use memcmp() to compare ClientGUIDs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74521",
    "datePublished": "2026-08-15T12:27:39.330Z",
    "dateReserved": "2026-08-15T05:44:03.911Z",
    "dateUpdated": "2026-08-17T05:48:13.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74521",
      "date": "2026-09-05",
      "epss": "0.00315",
      "percentile": "0.23913"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:02:02.000Z",
      "cve": "CVE-2026-74521",
      "id": "msrc_CVE-2026-74521",
      "initial_release_date": "2026-08-23T15:02:02.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: use memcmp() to compare ClientGUIDs",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74521.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74521\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:17:57.333\",\"lastModified\":\"2026-08-17T06:19:48.950\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: use memcmp() to compare ClientGUIDs\\n\\nClientGUID is a fixed-size binary value and can contain embedded NUL\\nbytes. strncmp() stops comparing at the first NUL byte, so different\\nClientGUID values can incorrectly be treated as equal.\\n\\nUse memcmp() in SMB3 multichannel session binding and\\nFSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE\\nbytes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"d535363299822c5caa543787b21bd5cfa3e41949\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"e8bb506e6ef749ac0336f3e579d8d02396b7d832\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/d535363299822c5caa543787b21bd5cfa3e41949\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:50:14+00:00",
      "cve": "CVE-2026-74521",
      "id": "CVE-2026-74521",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: use memcmp() to compare ClientGUIDs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74521.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.