Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal. Use memcmp() in SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE bytes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-15T13:17:57.333Z",
  "pubdate": "2026-08-15T13:17:57.333Z",
  "executiveSummary": "A logic vulnerability exists within the Linux kernel ksmbd implementation concerning the handling and validation of ClientGUID values during SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO operations. The vulnerability stems from the improper use of string-based comparison functions rather than binary-safe comparison methods on fixed-size binary structures containing embedded null bytes. Specifically, the utilization of strncmp() causes comparison logic to prematurely terminate at the first null byte encountered within the ClientGUID buffer. This architectural flaw allows distinct ClientGUID values to be incorrectly evaluated as matching when the prefix data up to the initial null byte is identical. Affected systems include Linux kernel environments utilizing the in-kernel ksmbd server for SMB3 protocol communication and multichannel operations. The risk implications involve potential authentication bypass or unauthorized session binding anomalies, where an attacker could spoof or manipulate client identifiers to subvert session integrity checks. Attacker capabilities require network-level access to the ksmbd service, enabling the transmission of crafted SMB3 negotiation sequences or multichannel bind requests containing maliciously crafted ClientGUID payloads. Exploitation requirements mandate that the target system exposes the ksmbd server over the network and processes SMB3 multichannel or validate negotiate requests.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper processing of fixed-size binary fields within the ksmbd server codebase. The ClientGUID is defined as a binary identifier of a specific fixed size, designated by SMB2_CLIENT_GUID_SIZE, and is not a null-terminated string. Despite its binary nature, the affected code previously utilized the standard C library function strncmp() to compare incoming ClientGUID parameters against expected or stored values during SMB3 multichannel session binding and the processing of the FSCTL_VALIDATE_NEGOTIATE_INFO function. The strncmp() function is fundamentally designed to operate on null-terminated ASCII or UTF-8 strings, meaning it halts comparison operations immediately upon encountering a null byte (0x00). When a ClientGUID contains embedded null bytes within its binary structure, strncmp() fails to evaluate the remaining bytes that follow the initial null byte. Consequently, two completely different ClientGUID structures that share an identical byte sequence prior to the first null byte will yield a comparison result of zero, incorrectly signaling equality to the caller. The vulnerable components involve the session management and dialect validation routines within the ksmbd server handling SMB2/SMB3 protocol flows. Network exposure is present wherever the ksmbd kernel daemon is active and listening for incoming SMB connections. Authentication and privilege requirements depend on the specific SMB command flow, but multichannel session binding typically occurs during or immediately following session establishment phases. Exploitation occurs step-by-step as an unauthenticated or authenticated network attacker crafts an SMB3 session bind request or an FSCTL_VALIDATE_NEGOTIATE_INFO request containing a manipulated ClientGUID. The attacker constructs a GUID value where the prefix matches a legitimate, existing session or target GUID up to an embedded null byte, while the subsequent bytes differ arbitrarily. When ksmbd processes the request, it invokes the vulnerable comparison logic using strncmp(). Because the function stops at the first null byte, the mismatched trailing bytes are ignored, causing the kernel to falsely authenticate or bind the malicious channel to the victim session. Post-exploitation impact includes unauthorized access to shared resources, session hijacking, or state confusion within the multichannel SMB3 connection handling layer, potentially leading to data compromise or unauthorized administrative interactions over the SMB protocol."
}