CVE-2026-74494

Received Received - Intake

Memory Leak in ksmbd SMB2 NEGOTIATE Request Handling

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. While the connection is in KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another SMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation. Only the final allocation is freed when the connection is released, leaking one object for every additional successful request. A repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol violation. MS-SMB2 section 3.3.5.4 requires the server to disconnect without replying in this case. Set the connection exiting when rejecting the request, in addition to suppressing the response. Reject SMB2 NEGOTIATE unless the connection is new or is waiting for the SMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize both SMB1 and SMB2 negotiation paths under conn->srv_mutex, since they update connection-wide dialect and negotiation state. Move the locking contract to ksmbd_smb_negotiate_common(), where the state and dialect are selected, and add ksmbd_conn_new() for consistent state access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74494

EUVD

EUVD-2026-59687

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	ksmbd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's ksmbd component involves a memory leak caused by unauthenticated clients sending multiple SMB2 NEGOTIATE requests before session setup. Each additional request overwrites connection state and leaks memory, as only the final allocation is freed when the connection closes.

Detection Guidance

Detecting this vulnerability requires monitoring for repeated SMB2 NEGOTIATE requests on ksmbd connections. Check kernel logs for ksmbd-related errors or unusual negotiation patterns. Use tools like tcpdump or Wireshark to capture SMB traffic and look for multiple NEGOTIATE requests before SESSION_SETUP on the same connection.

Impact Analysis

The vulnerability allows unauthenticated attackers to cause memory leaks on affected systems, potentially leading to denial-of-service conditions by exhausting available memory resources over time.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a protocol violation in the SMB2 NEGOTIATE request handling that could lead to memory leaks but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this ksmbd vulnerability. Disable ksmbd if not needed. Monitor network traffic for SMB2 NEGOTIATE anomalies. Restrict SMB access to trusted networks only.

Hi! I’m here to help you understand CVE-2026-74494. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70