Skip to main content

ksmbd EUVDEUVD-2026-59714

| CVE-2026-74521 CRITICAL
2026-08-15 Linux GHSA-336h-563m-gwm9
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.1 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.4 HIGH

Network-reachable and unauthenticated, but requires an active target session plus a prefix-colliding ClientGUID, so AC:H; session hijack yields high confidentiality and integrity, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 12:05 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.1 (CRITICAL)
CVE Published
Aug 15, 2026 - 12:27 cve.org
CRITICAL 9.1
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use memcmp() to compare ClientGUIDs

ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal.

Use memcmp() in SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE bytes.

AnalysisAI

Session-binding authentication weakness in the Linux kernel's ksmbd in-kernel SMB3 server allows different SMB clients to be treated as identical because ClientGUID values were compared with strncmp(), which halts at the first embedded NUL byte. An attacker able to reach an exposed ksmbd share could exploit this to bind to another client's authenticated SMB3 multichannel session or bypass FSCTL_VALIDATE_NEGOTIATE_INFO integrity checks, exposing high confidentiality and integrity impact per the CVSS 9.1 rating. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach exposed ksmbd SMB share on TCP/445
Delivery
Craft ClientGUID with early embedded NUL byte
Exploit
Send SMB3 session-bind or VALIDATE_NEGOTIATE request
Execution
strncmp() falsely matches victim ClientGUID
Persist
Bind channel to victim's authenticated session
Impact
Access or tamper with SMB data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target to be running the Linux kernel ksmbd in-kernel SMB server with shares exposed on the network (a non-default configuration, as most deployments use userspace Samba), and specifically requires the SMB3 multichannel session-binding path or an FSCTL_VALIDATE_NEGOTIATE_INFO exchange to be reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N, base 9.1) portrays a trivially exploitable network attack, but several signals temper this. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with network access to a host running an exposed ksmbd share crafts SMB3 session-binding or FSCTL_VALIDATE_NEGOTIATE_INFO requests using a ClientGUID containing an embedded NUL byte early in the value, causing ksmbd's strncmp() check to match it against a different, already-authenticated client. By colliding on the pre-NUL prefix, the attacker binds a channel to the victim's session and gains access to that session's authenticated context, reading or tampering with SMB data. …
Remediation Upstream fix available (commits d535363299822c5caa543787b21bd5cfa3e41949 and e8bb506e6ef749ac0336f3e579d8d02396b7d832 on git.kernel.org); update to a kernel that includes the memcmp() correction - the EUVD data references stable 7.1.8 and mainline ~7.2-rc6 as patched, so apply your distribution's kernel update that incorporates these commits rather than relying on an unverified upstream tag. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Linux systems running ksmbd and their network exposure by checking for active SMB3 shares on port 445; create an inventory categorizing which serve critical data. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59714 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy