The Linux kernel vulnerability CVE-2026-64391 concerns the ksmbd server's handling of Alternate Data Streams (ADS) I/O. ADS are stored as extended attributes (xattrs), and their I/O paths invoke VFS xattr helpers that recheck inode permissions and Linux Security Module (LSM) policies using the current task credentials. The vulnerability was that ADS I/O did not use the opener's credentials captured at SMB handle opening, potentially causing permission checks to be bypassed or incorrectly applied. The issue has been resolved by ensuring ADS I/O uses the opener credentials for permission checks.

If exploited, this vulnerability could allow unauthorized access or modification of ADS data by bypassing intended permission checks, potentially leading to information disclosure or data integrity issues within SMB shares handled by ksmbd. However, no known exploits are reported in the wild.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to ensure ADS I/O operations use the correct opener credentials. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should verify with the Linux kernel vendor advisory for the exact fixed versions and update accordingly.