CVE-2026-74521 ksmbd: use memcmp() to compare ClientGUIDs
An attacker can bypass SMB3 multichannel session binding checks by exploiting incorrect ClientGUID comparison logic in the Linux kernel ksmbd module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74521?
CVE-2026-74521 is a critical authentication bypass vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: use memcmp() to compare ClientGUIDs
ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal.
Use memcmp() in SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE bytes.
Which versions are affected by CVE-2026-74521?
How do I fix CVE-2026-74521?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-74521 being exploited?
There is no known exploitation of CVE-2026-74521 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74521, DEBIAN-CVE-2026-74521, GHSA-336h-563m-gwm9, UBUNTU-CVE-2026-74521.