1. Home
  2. Vulnerabilities
  3. CVE-2026-74494
0.0
NA
CVE-2026-74494
ksmbd: reject repeated SMB2 NEGOTIATE requests
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. While the connection is in KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another SMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation. Only the final allocation is freed when the connection is released, leaking one object for every additional successful request. A repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol violation. MS-SMB2 section 3.3.5.4 requires the server to disconnect without replying in this case. Set the connection exiting when rejecting the request, in addition to suppressing the response. Reject SMB2 NEGOTIATE unless the connection is new or is waiting for the SMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize both SMB1 and SMB2 negotiation paths under conn->srv_mutex, since they update connection-wide dialect and negotiation state. Move the locking contract to ksmbd_smb_negotiate_common(), where the state and dialect are selected, and add ksmbd_conn_new() for consistent state access.

Details
INFO

Published Date :

Aug. 15, 2026, 1:17 p.m.

Last Modified :

Aug. 23, 2026, 1:16 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-74494 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Solution
Reject repeated SMB2 NEGOTIATE requests to prevent resource leaks and connection issues.
  • Apply kernel patches to reject repeated SMB2 NEGOTIATE requests.
  • Ensure proper handling of negotiation states and dialect selections.
  • Serialize negotiation paths using connection mutexes.
  • Update connection state access for consistent handling.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-74494.

URL Resource
https://git.kernel.org/stable/c/0b1390cf2b6b91723b37c0909dd123f7a5eba1a7
https://git.kernel.org/stable/c/7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe
https://git.kernel.org/stable/c/7fb8dbeb3f2868ae836ca12311d89aed16fc2927
https://git.kernel.org/stable/c/81e21cb7bd1479bb5238e0004a7e0110452c610b
https://git.kernel.org/stable/c/a60b5da05e318d9a364dbac38c347c7f24e625e7
https://git.kernel.org/stable/c/cb469993b3a61a72653770856d37af616d72d05f
https://git.kernel.org/stable/c/fd6a6c43f96b40a08a22ff62f08d194a49741c8a
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-74494 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-74494 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-74494 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-74494 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 23, 2026

    Action Type Old Value New Value
    Added Reference https://git.kernel.org/stable/c/0b1390cf2b6b91723b37c0909dd123f7a5eba1a7
    Added Reference https://git.kernel.org/stable/c/7fb8dbeb3f2868ae836ca12311d89aed16fc2927
    Added Reference https://git.kernel.org/stable/c/81e21cb7bd1479bb5238e0004a7e0110452c610b
    Added Reference https://git.kernel.org/stable/c/fd6a6c43f96b40a08a22ff62f08d194a49741c8a
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'a60b5da05e318d9a364dbac38c347c7f24e625e7', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': '7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'cb469993b3a61a72653770856d37af616d72d05f', 'versionType': 'git'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': '0b1390cf2b6b91723b37c0909dd123f7a5eba1a7', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'fd6a6c43f96b40a08a22ff62f08d194a49741c8a', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': '81e21cb7bd1479bb5238e0004a7e0110452c610b', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': '7fb8dbeb3f2868ae836ca12311d89aed16fc2927', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'a60b5da05e318d9a364dbac38c347c7f24e625e7', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': '7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'cb469993b3a61a72653770856d37af616d72d05f', 'versionType': 'git'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.217', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.184', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.153', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.105', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'affected'}]
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'a60b5da05e318d9a364dbac38c347c7f24e625e7', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': '7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'cb469993b3a61a72653770856d37af616d72d05f', 'versionType': 'git'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'a60b5da05e318d9a364dbac38c347c7f24e625e7', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': '7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'cb469993b3a61a72653770856d37af616d72d05f', 'versionType': 'git'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'a60b5da05e318d9a364dbac38c347c7f24e625e7', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': '7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe', 'versionType': 'git'}, {'status': 'affected', 'version': 'e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9', 'lessThan': 'cb469993b3a61a72653770856d37af616d72d05f', 'versionType': 'git'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.15'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.15', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/connection.h', 'fs/smb/server/smb2pdu.c', 'fs/smb/server/smb_common.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. While the connection is in KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another SMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation. Only the final allocation is freed when the connection is released, leaking one object for every additional successful request. A repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol violation. MS-SMB2 section 3.3.5.4 requires the server to disconnect without replying in this case. Set the connection exiting when rejecting the request, in addition to suppressing the response. Reject SMB2 NEGOTIATE unless the connection is new or is waiting for the SMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize both SMB1 and SMB2 negotiation paths under conn->srv_mutex, since they update connection-wide dialect and negotiation state. Move the locking contract to ksmbd_smb_negotiate_common(), where the state and dialect are selected, and add ksmbd_conn_new() for consistent state access.
    Added Reference https://git.kernel.org/stable/c/7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe
    Added Reference https://git.kernel.org/stable/c/a60b5da05e318d9a364dbac38c347c7f24e625e7
    Added Reference https://git.kernel.org/stable/c/cb469993b3a61a72653770856d37af616d72d05f
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.