01 Record

CVE-2026-74494

ksmbd: reject repeated SMB2 NEGOTIATE requests

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

ksmbd: reject repeated SMB2 NEGOTIATE requests

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.21% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 11.7% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Received. NVD last modified this record on 2026-08-23.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2026-08-15 12:27Z2 MO AGO
Last updated: 2026-08-23 12:47Z2 MO AGO
Reserved: 2026-08-15
Assigning CNA: Linux
Record state: PUBLISHED
Severity: Not rated by the issuing CNA
CNA CVSS vector: Not published by the issuing CNA
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: b9b12e2c85c9fcba2ba3a726c273cf48f48a359bd3e166443b690848fde4f352

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 0b1390cf2b6b91723b37c0909dd123f7a5eba1a7, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < fd6a6c43f96b40a08a22ff62f08d194a49741c8a, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 81e21cb7bd1479bb5238e0004a7e0110452c610b, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 7fb8dbeb3f2868ae836ca12311d89aed16fc2927, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < a60b5da05e318d9a364dbac38c347c7f24e625e7, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < 7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe, e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to < cb469993b3a61a72653770856d37af616d72d05f, 5.15—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/0b1390cf2b6b91723b37c0909dd123f7a5eba1a7
git.kernel.orghttps://git.kernel.org/stable/c/fd6a6c43f96b40a08a22ff62f08d194a49741c8a
git.kernel.orghttps://git.kernel.org/stable/c/81e21cb7bd1479bb5238e0004a7e0110452c610b
git.kernel.orghttps://git.kernel.org/stable/c/7fb8dbeb3f2868ae836ca12311d89aed16fc2927
git.kernel.orghttps://git.kernel.org/stable/c/a60b5da05e318d9a364dbac38c347c7f24e625e7
git.kernel.orghttps://git.kernel.org/stable/c/7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe
git.kernel.orghttps://git.kernel.org/stable/c/cb469993b3a61a72653770856d37af616d72d05f

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1
linux-6.12
Fixed in 6.12.107-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.105-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.8-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.