Bug 2517057 (CVE-2026-74521)

Summary:	CVE-2026-74521 kernel: ksmbd: use memcmp() to compare ClientGUIDs
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel Server Message Block (SMB) server. This vulnerability stems from a logic error in how ClientGUIDs, which are unique client identifiers, are compared. The `strncmp()` function, used for this comparison, stops at the first null byte, causing different ClientGUID values to be incorrectly treated as identical. This could lead to misidentification of clients during SMB3 multichannel session binding and validation, potentially impacting session integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 12:47:17 UTC

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use memcmp() to compare ClientGUIDs

ClientGUID is a fixed-size binary value and can contain embedded NUL
bytes. strncmp() stops comparing at the first NUL byte, so different
ClientGUID values can incorrectly be treated as equal.

Use memcmp() in SMB3 multichannel session binding and
FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE
bytes.

Comment 1 Mauro Matteo Cascella 2026-08-19 17:29:45 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081544-CVE-2026-74521-7ade@gregkh/T