CVE-2026-74494

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An unauthenticated client can trigger a memory leak by sending multiple successful SMB2 NEGOTIATE requests on a single connection before the SESSION SETUP phase. When the connection is in the KSMBD SESS NEED SETUP state, the smb2 handle negotiate() function accepts subsequent SMB3.1.1 NEGOTIATE requests and overwrites the conn->preauth info variable with a new allocation. Because only the final allocation is freed upon connection release, each additional request leaks one object. This behavior violates the MS-SMB2 protocol, which requires the server to disconnect without replying if a repeated SMB2 NEGOTIATE occurs after a dialect has been selected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.