CVE-2026-74521: ksmbd: use memcmp() to compare ClientGUIDs

Published Aug 15, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use memcmp() to compare ClientGUIDs

ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal.

Use memcmp() in SMB3 multichannel session binding and FSCTLVALIDATENEGOTIATEINFO to compare all SMB2CLIENTGUIDSIZE bytes.

Affected Software

1 affected component

Linux Linux kernel

Event History

Aug 15, 2026

CVE Published

via MITRE·12:27 PM

Data Sourced

via MITRE·12:27 PM

Description

Frequently Asked Questions

What is the severity of CVE-2026-74521?

The severity of CVE-2026-74521 is rated as 27.

How do I fix CVE-2026-74521?

To fix CVE-2026-74521, ensure that your Linux kernel is updated to the patched version that resolves the issue.

What is the impact of CVE-2026-74521?

CVE-2026-74521 can lead to incorrect handling of ClientGUID values, causing different values to be treated as equivalent.

Which systems are affected by CVE-2026-74521?

CVE-2026-74521 affects systems running the Linux kernel with the ksmbd module.

When was CVE-2026-74521 published?

CVE-2026-74521 was published on August 15, 2026.