CVE-2026-74494

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: reject repeated SMB2 NEGOTIATE requests

Unauthenticated client can send multiple successful SMB2 NEGOTIATE

requests on one connection before SESSION_SETUP. While the connection is

in KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another

SMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation.

Only the final allocation is freed when the connection is released, leaking

one object for every additional successful request.

A repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol

violation. MS-SMB2 section 3.3.5.4 requires the server to disconnect

without replying in this case. Set the connection exiting when rejecting

the request, in addition to suppressing the response.

Reject SMB2 NEGOTIATE unless the connection is new or is waiting for the

SMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize

both SMB1 and SMB2 negotiation paths under conn->srv_mut

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References