In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as… (CVE-2026-64391)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to ensure ADS I/O operations use the correct opener credentials. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should verify with the Linux kernel vendor advisory for the exact fixed versions and update accordingly.
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the current task credentials. Run ADS I/O with the credentials captured when the SMB handle was opened.
Impact
If exploited, this vulnerability could allow unauthorized access or modification of ADS data by bypassing intended permission checks, potentially leading to information disclosure or data integrity issues within SMB shares handled by ksmbd. However, no known exploits are reported in the wild.
Summary
The Linux kernel vulnerability CVE-2026-64391 concerns the ksmbd server's handling of Alternate Data Streams (ADS) I/O. ADS are stored as extended attributes (xattrs), and their I/O paths invoke VFS xattr helpers that recheck inode permissions and Linux Security Module (LSM) policies using the current task credentials. The vulnerability was that ADS I/O did not use the opener's credentials captured at SMB handle opening, potentially causing permission checks to be bypassed or incorrectly applied. The issue has been resolved by ensuring ADS I/O uses the opener credentials for permission checks.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64391 (opens in a new tab)
- git.kernel.org/stable/c/2b4592cea214683de0f2ce6f8c22c097fb0ea1ab (opens in a new tab)
- git.kernel.org/stable/c/52a56cf53ec834c44ac1b4d16d585f26613ee5ce (opens in a new tab)
- git.kernel.org/stable/c/a8f5d39971bbad9340d49cd41b0e2da9452a649d (opens in a new tab)
- git.kernel.org/stable/c/baa5e094886fffa7e6272edcb5e08be5ce28262c (opens in a new tab)