Vulnerability-Lookup

GHSA-336H-563M-GWM9

Vulnerability from github – Published: 2026-08-15 15:30 – Updated: 2026-10-03 12:31

Details

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use memcmp() to compare ClientGUIDs

ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal.

Use memcmp() in SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE bytes.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74521"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T13:17:57Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use memcmp() to compare ClientGUIDs\n\nClientGUID is a fixed-size binary value and can contain embedded NUL\nbytes. strncmp() stops comparing at the first NUL byte, so different\nClientGUID values can incorrectly be treated as equal.\n\nUse memcmp() in SMB3 multichannel session binding and\nFSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE\nbytes.",
  "id": "GHSA-336h-563m-gwm9",
  "modified": "2026-10-03T12:31:04Z",
  "published": "2026-08-15T15:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74521"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a0367bf5ce420be7b19936def2e90adcf32a683"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7bde6f181fa307d2cc1ec2b0313ac8e9811c8232"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a386c83043015a703e227775f778e40343f45911"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ba2a5b66f1d414eb8403d655f8813783892cfc85"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d535363299822c5caa543787b21bd5cfa3e41949"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-74521 (GCVE-0-2026-74521)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-10-03 10:56

Title

ksmbd: use memcmp() to compare ClientGUIDs

Summary

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal. Use memcmp() in SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE bytes.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

6 references

URL	Tags
https://git.kernel.org/stable/c/7bde6f181fa307d2c…
https://git.kernel.org/stable/c/5a0367bf5ce420be7…
https://git.kernel.org/stable/c/ba2a5b66f1d414eb8…
https://git.kernel.org/stable/c/a386c83043015a703…
https://git.kernel.org/stable/c/d535363299822c5ca…
https://git.kernel.org/stable/c/e8bb506e6ef749ac0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 7bde6f181fa307d2cc1ec2b0313ac8e9811c8232 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 5a0367bf5ce420be7b19936def2e90adcf32a683 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < ba2a5b66f1d414eb8403d655f8813783892cfc85 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < a386c83043015a703e227775f778e40343f45911 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < d535363299822c5caa543787b21bd5cfa3e41949 (git) Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < e8bb506e6ef749ac0336f3e579d8d02396b7d832 (git)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7bde6f181fa307d2cc1ec2b0313ac8e9811c8232",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "5a0367bf5ce420be7b19936def2e90adcf32a683",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "ba2a5b66f1d414eb8403d655f8813783892cfc85",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "a386c83043015a703e227775f778e40343f45911",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "d535363299822c5caa543787b21bd5cfa3e41949",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "e8bb506e6ef749ac0336f3e579d8d02396b7d832",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use memcmp() to compare ClientGUIDs\n\nClientGUID is a fixed-size binary value and can contain embedded NUL\nbytes. strncmp() stops comparing at the first NUL byte, so different\nClientGUID values can incorrectly be treated as equal.\n\nUse memcmp() in SMB3 multichannel session binding and\nFSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE\nbytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in ksmbd\u0027s in-kernel SMB server on TCP/445; vulnerable ClientGUID comparisons run while handling remotely supplied SMB2 SESSION_SETUP multichannel binding and SMB2 IOCTL FSCTL_VALIDATE_NEGOTIATE_INFO requests from any network peer.\nAC:L - The attacker controls negotiate ClientGUID bytes (including embedded NULs), can open many TCP connections, brute-force sequential session IDs, and repeatedly attempt binding until strncmp accepts a prefix-colliding GUID without conditions outside attacker control.\nPR:N - Multichannel SESSION_SETUP binding is processed before the attacker authenticates; once a victim SMB2_SESSION_VALID session is targeted, ntlm_authenticate skips password verification on rebind, requiring only network reachability plus session ID and username guessing, not a valid server account.\nUI:N - Exploitation requires no victim interaction such as opening files, mounting shares, or clicking links; the attacker drives negotiate, binding, and IOCTL requests directly against the exposed SMB service.\nS:U - Successful exploitation grants unauthorized use of an existing SMB session and its exported share access within ksmbd\u0027s authority, not crossing into another security domain such as host kernel privilege or VM escape.\nC:H - Bypassing ClientGUID verification enables hijacking another client\u0027s authenticated SMB3 multichannel session, providing read access to all files, directories, and metadata that victim session may access on server exports.\nI:H - A fraudulently bound channel receives the victim session\u0027s channel signing keys and full SMB operation rights, allowing arbitrary create, write, modify, and delete of files and objects permitted to that hijacked session.\nA:N - This is a logical string-comparison flaw causing incorrect authorization decisions, not memory corruption or a crash primitive; exploitation does not inherently panic, oops, or deny kernel or ksmbd availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:56:04.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7bde6f181fa307d2cc1ec2b0313ac8e9811c8232"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a0367bf5ce420be7b19936def2e90adcf32a683"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba2a5b66f1d414eb8403d655f8813783892cfc85"
        },
        {
          "url": "https://git.kernel.org/stable/c/a386c83043015a703e227775f778e40343f45911"
        },
        {
          "url": "https://git.kernel.org/stable/c/d535363299822c5caa543787b21bd5cfa3e41949"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832"
        }
      ],
      "title": "ksmbd: use memcmp() to compare ClientGUIDs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74521",
    "datePublished": "2026-08-15T12:27:39.330Z",
    "dateReserved": "2026-08-15T05:44:03.911Z",
    "dateUpdated": "2026-10-03T10:56:04.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted