In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be… (CVE-2026-64392)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to address this vulnerability by using the opener's credentials for delete-on-close operations. Users should apply the official kernel updates that include this patch to remediate the issue. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks. Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user's fsuid, fsgid, supplementary groups and capability restrictions at final close.
Impact
An attacker able to trigger delete-on-close operations could bypass filesystem permission checks, potentially deleting files or removing extended attributes without proper authorization. This undermines filesystem security and could lead to unauthorized data modification or loss.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64392 (opens in a new tab)
- git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d (opens in a new tab)
- git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d (opens in a new tab)
- git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0 (opens in a new tab)
- git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9 (opens in a new tab)
- git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b (opens in a new tab)