CVE-2026-64138

Analyzed Analyzed - Analysis Complete

ksmbd ACL Inheritance SID Validation Flaw

Publication date: 2026-07-19

Last updated on: 2026-08-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smb_validate_ntsd_sid() helper to safely validate Owner SID and Group SID inside the NT Security Descriptor (smb_ntsd) retrieved from the parent directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-18

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64138

EUVD

EUVD-2026-45823

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 5.15 (inc) to 6.12.92 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ksmbd (Samba) module where the SID (Security Identifier) in a parent directory's security descriptor is not properly validated during ACL (Access Control List) inheritance. This could allow unauthorized access or privilege escalation if an attacker manipulates SIDs in a way that bypasses intended security controls.

Detection Guidance

This vulnerability involves ksmbd in the Linux kernel and requires validating SID in security descriptors during ACL inheritance. Detection involves checking kernel logs for ksmbd-related errors or crashes, verifying ksmbd module versions, and monitoring for unusual SMB traffic patterns. Use commands like dmesg | grep ksmbd, lsmod | grep ksmbd, and journalctl -u ksmbd to inspect logs and module status.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized access to files or directories, escalate privileges, or bypass security restrictions. Systems using ksmbd for SMB file sharing could be at risk if the kernel version is vulnerable and not patched.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if the flaw is exploited to access sensitive data without proper authorization.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the ksmbd SID validation issue in ACL inheritance.

Hi! I’m here to help you understand CVE-2026-64138. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70