UBUNTU-CVE-2026-74521: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal. Use memcmp() in SMB3 multichannel session binding and FSCTLVALIDATENEGOTIATEINFO to compare all SMB2CLIENTGUIDSIZE bytes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu kernel packages for the standard, realtime, Azure, GCP, Azure FDE, GKE, RISC-V, and GKEop variants. The affected code is ksmbd, so exposure is relevant where the kernel SMB server functionality is in use.
What does an attacker need to exploit it?
An attacker needs low privileges and network access, and exploitation depends on a race or other timing condition as indicated by the AT:P vector. The issue involves SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO processing.
What is the impact of successful exploitation?
Different ClientGUID values containing embedded NUL bytes may be treated as equal because the vulnerable comparison stops at the first NUL byte. The provided vector indicates low impact to confidentiality and integrity, with no availability impact.
How can I determine whether this flaw affects my environment?
Determine whether the host runs one of the listed Ubuntu kernel variants and uses ksmbd for SMB serving. Environments not using the kernel SMB server are not implicated by the affected code paths described.