In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid… (CVE-2026-64379)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been applied to the Linux kernel to correctly mask the server-provided mode to 07777 in the modefromsid function. Users should update their Linux kernel to a version that includes this fix once it is available.
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. Apply the correct masking, same as in the read path.
Impact
Incorrect masking of server-provided mode bits could lead to improper file permission settings on SMB client mounts, potentially resulting in privilege escalation or unauthorized access if permissions are incorrectly granted. However, no known exploits are reported in the wild for this vulnerability.
Summary
The vulnerability in the Linux kernel SMB client relates to improper handling of server-provided mode bits in the modefromsid function. Specifically, when modefromsid is active, parse_dacl() uses the sub_auth[2] value from the NFS mode SID to set cf_mode but fails to mask it to 07777, potentially allowing unintended permission bits to be set. The resolution involves applying the correct 07777 mask to the mode, aligning with the behavior in the read path, thereby preventing incorrect permission assignments.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64379 (opens in a new tab)
- git.kernel.org/stable/c/08c600b7e1818539ba5efee4cdb06215c245ca78 (opens in a new tab)
- git.kernel.org/stable/c/5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14 (opens in a new tab)
- git.kernel.org/stable/c/b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d (opens in a new tab)
- git.kernel.org/stable/c/c6c484a7d5bff6b929a86d7ed5130f29834c6a0d (opens in a new tab)
- git.kernel.org/stable/c/e3d9c7160d483fc8f9e225aafad8ecbbc43f3151 (opens in a new tab)
- git.kernel.org/stable/c/ee2216dbdf0c677e89bb43e03247dba590ed00ef (opens in a new tab)
- git.kernel.org/stable/c/f511807feee7cb29b61bdfa86472c7e9e2e5df94 (opens in a new tab)
- git.kernel.org/stable/c/f80add1bfb3425100a325b14f19648e75669a954 (opens in a new tab)