9.1

CVE-2026-74521

ksmbd: use memcmp() to compare ClientGUIDs

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use memcmp() to compare ClientGUIDs

ClientGUID is a fixed-size binary value and can contain embedded NUL
bytes. strncmp() stops comparing at the first NUL byte, so different
ClientGUID values can incorrectly be treated as equal.

Use memcmp() in SMB3 multichannel session binding and
FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE
bytes.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Version < d535363299822c5caa543787b21bd5cfa3e41949
Status affected
Version e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Version < e8bb506e6ef749ac0336f3e579d8d02396b7d832
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.15
Status affected
Version 0
Version < 5.15
Status unaffected
Version <= 7.1.*
Version 7.1.8
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.242
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/d535363299822c5caa543787b21bd5cfa3e41949
https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832