CVE-2026-64391

Awaiting Analysis Awaiting Analysis - Queue

ksmbd ADS I/O Credential Handling Vulnerability

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the current task credentials. Run ADS I/O with the credentials captured when the SMB handle was opened.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-24

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64391

EUVD

EUVD-2026-48935

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 5.15 (inc) to 6.12.96 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves ksmbd, a server implementing the SMB/CIFS protocol. It allows alternate data streams (ADS) to be stored as extended attributes (xattrs). When reading or writing ADS, the kernel uses VFS xattr helpers that recheck permissions and security policies using the current task's credentials. The fix ensures ADS I/O operations use the credentials captured when the SMB handle was opened, preventing unauthorized access.

Detection Guidance

This vulnerability is specific to the ksmbd implementation in the Linux kernel and relates to alternate data stream handling. Detection would require checking kernel logs for related errors or monitoring ksmbd operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to bypass intended permission checks on ADS operations. This might lead to unauthorized access to sensitive data stored in alternate data streams, potentially exposing confidential information or enabling further system compromise.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The vulnerability involves ksmbd handling alternate data streams with opener credentials, but no direct impact on regulatory compliance is mentioned.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the ksmbd ADS I/O credential handling issue.

Hi! I’m here to help you understand CVE-2026-64391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70