CVE-2026-64394
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to fsctl_set_sparse and noted that "similar handle-level checks exist in other functions but are missing here." The SMB2 SET_INFO SECURITY arm is one of the missing ones, and the most security-relevant: smb2_set_info_sec() calls set_info_sec() with no per-handle access check. set_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it rewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via set_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and rewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr(). Every other persistent-mutation arm of the sibling handler smb2_set_info_file() checks fp->daccess first (FILE_WRITE_DATA / FILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm — which mutates the access control itself — is the only one with no gate. A client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no FILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType SMB2_O_INFO_SECURITY to rewrite the file's DACL and owner, granting itself access the handle's daccess never carried. Unlike the FSCTL data arms this is a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop — the missing fp->daccess check is the entire gate. Setting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so require at least one of those on the handle before re-permissioning the file. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64394
EUVD
EUVD-2026-48938

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel ksmbd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's ksmbd component allows a client to bypass access controls by exploiting a missing permission check in the SMB2 SET_INFO SECURITY operation. Specifically, a client can open a file handle with limited permissions (FILE_WRITE_ATTRIBUTES only) and then use SMB2_SET_INFO with InfoType SMB2_O_INFO_SECURITY to rewrite the file's Discretionary Access Control List (DACL) and owner, granting itself unauthorized access.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized changes to file permissions or security descriptors via SMB2_SET_INFO SECURITY operations. Monitor ksmbd logs for suspicious SET_INFO SECURITY requests without proper FILE_WRITE_DAC or FILE_WRITE_OWNER permissions. Check for unexpected modifications to file ownership, group, or ACLs using commands like 'ls -l' or 'getfacl' on shared directories.

Impact Analysis

This vulnerability could allow an attacker with limited access to a shared file to escalate their privileges. By modifying the file's security settings, they could gain unauthorized access to sensitive data or perform actions beyond their intended permissions. This affects systems using ksmbd for SMB file sharing.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection standards like GDPR and HIPAA. It undermines access control mechanisms, potentially resulting in data breaches and non-compliance with regulatory mandates for data security and privacy.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve the missing permission check in ksmbd. Ensure SMB shares enforce strict access controls and audit logs for SET_INFO SECURITY operations. Restrict WRITE_DAC and WRITE_OWNER permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart