CVE-2026-74521

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel Server Message Block (SMB) server. This vulnerability stems from a logic error in how ClientGUIDs, which are unique client identifiers, are compared. The strncmp() function, used for this comparison, stops at the first null byte, causing different ClientGUID values to be incorrectly treated as identical. This could lead to misidentification of clients during SMB3 multichannel session binding and validation, potentially impacting session integrity.

This vulnerability is rated as Moderate impact because client identifier confusion during multichannel session binding requires network access to an active in-kernel SMB service and does not permit arbitrary code execution. Red Hat Enterprise Linux does not enable or ship the ksmbd kernel module, relying exclusively on user-space Samba to deliver SMB services. Consequently, Red Hat Enterprise Linux systems are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.