CVE-2026-64379

Awaiting Analysis Awaiting Analysis - Queue

Linux Kernel SMB Client Mode Permission Bypass

Publication date: 2026-07-25

Last updated on: 2026-09-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. Apply the correct masking, same as in the read path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-08

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64379

EUVD

EUVD-2026-48923

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 5.4 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of file permissions when the modefromsid feature is active. The server-provided mode value is applied without proper masking to 07777, which could lead to incorrect file permissions being set.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and relates to improper handling of file permissions when using modefromsid. Detection requires checking if your system is running a vulnerable kernel version and verifying if the smb client is affected. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability may allow unauthorized access to files or directories due to incorrect permission settings. Attackers could exploit it to read, modify, or execute files they should not have access to.

Compliance Impact

The vulnerability involves improper masking of server-provided file permissions in the Linux kernel's SMB client, potentially allowing unauthorized access to sensitive data. This could impact compliance with GDPR by risking unauthorized data exposure and HIPAA by compromising protected health information integrity.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the smb client modefromsid vulnerability. Monitor vendor advisories for updates and test patches in a non-production environment before deployment.

Hi! I’m here to help you understand CVE-2026-64379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70