The Linux kernel's SMB server (ksmbd) incorrectly compares binary ClientGUID values using strncmp, which stops comparison at the first embedded NUL byte. This means distinct ClientGUIDs can be treated as equal, allowing an attacker to forge a session binding that should not be permitted. The flaw is an improper input validation weakness. The potential consequence is unauthorized access to SMB resources or elevated privileges within a kernel context, as the attacker can bypass authentication checks during SMB3 multichannel session binding or FSCTL_VALIDATE_NEGOTIATE_INFO.

All Linux kernel installations that include ksmbd and have not applied the patch that replaces strncmp with memcmp() are vulnerable. The specific affected kernel versions are not listed in the provided data, so any kernel prior to the fix should be considered at risk.

The CVSS score of 9.1 indicates a high potential impact because it targets the authentication mechanism of the SMB protocol, but exploitation requires the attacker to send a crafted SMB3 request to a Linux machine exposing ksmbd. The EPSS score is < 1% and the issue is not listed in CISA's KEV catalog, indicating that widespread exploitation has not yet been observed. Nonetheless, the nature of the flaw allows privilege escalation or unauthorized access if an attacker can reach the SMB service. An attacker can likely exploit this remotely over the network using normal SMB traffic, making it relatively easy to trigger for an adversary with network connectivity.