Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance… (CVE-2026-64138)

CVE-2026-64138 addresses a vulnerability in the Linux kernel's ksmbd subsystem where the validation of SIDs in the parent security descriptor during ACL inheritance was insufficient. The fix introduces the smb_validate_ntsd_sid() helper function to safely validate Owner SID and Group SID inside the NT Security Descriptor (smb_ntsd) retrieved from the parent directory. This vulnerability could lead to privilege escalation or other security impacts due to improper ACL handling. The issue affects various linux-hwe-edge kernel versions prior to 7.0.0-28.28~24.04.1 and related builds. The vulnerability has been patched in updated kernel releases as per the Ubuntu security advisories USN-8593-1 and USN-8603-1.

The vulnerability allows improper validation of security identifiers during ACL inheritance in the ksmbd component of the Linux kernel, potentially enabling privilege escalation or unauthorized access. The CVSS score of 8.8 indicates a high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability. No known exploits in the wild have been reported. The issue affects multiple kernel versions used in Ubuntu HWE edge releases.

A patch is available and has been released by Ubuntu in the linux-hwe-edge kernel updates. Users should apply the latest kernel updates to versions 7.0.0-28.28~24.04.1 or later as provided by the Ubuntu security notices USN-8593-1 and USN-8603-1. After updating, a system reboot is required to apply the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigation steps are required beyond applying the official updates.