CVE-2026-64138: Linux Kernel ksmbd Privilege Escalation

CVE-2026-64138 Overview

CVE-2026-64138 is a Linux kernel vulnerability in the ksmbd in-kernel SMB3 server. The flaw resides in the Access Control List (ACL) inheritance logic, where the Security Identifier (SID) fields inside the NT Security Descriptor (smb_ntsd) retrieved from a parent directory were not validated before use. An authenticated remote attacker with SMB access can exploit the missing validation to trigger memory corruption or unauthorized access. The fix introduces the smb_validate_ntsd_sid() helper to safely validate Owner SID and Group SID values before ACL inheritance proceeds.

Critical Impact
Authenticated remote attackers on the network can achieve high-impact compromise of confidentiality, integrity, and availability on Linux systems running the ksmbd SMB server.

Affected Products

Linux kernel builds shipping the ksmbd in-kernel SMB server module
Distributions consuming stable kernel branches prior to the fixing commits
SMB file shares exported through ksmbd where clients can create objects with custom security descriptors

Discovery Timeline

2026-07-19 - CVE-2026-64138 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64138

Vulnerability Analysis

The vulnerability lives in the ksmbd module, which implements an SMB3 file server inside the Linux kernel. When a client creates a new object under a parent directory, ksmbd inherits ACL entries from the parent security descriptor. During this inheritance, the server reads the Owner SID and Group SID fields from the parent's smb_ntsd structure and applies them to the child object.

Prior to the patch, ksmbd accepted these SID fields without bounds or structural validation. A malformed or attacker-controlled parent security descriptor could contain SIDs with invalid SubAuthorityCount values or offsets that extend beyond the buffer. Because the inheritance path operated on unvalidated data inside kernel context, it could be steered to read or write memory outside the intended object.

Root Cause

The root cause is missing input validation on SID structures embedded in an NT Security Descriptor retrieved from disk or received over the wire. The patch introduces smb_validate_ntsd_sid(), which checks the SID length, subauthority count, and offsets before the inheritance code dereferences the fields.

Attack Vector

An attacker authenticates to an SMB share exported by ksmbd and creates or manipulates an object whose parent directory carries a crafted security descriptor. When ACL inheritance runs, the unvalidated SID triggers out-of-bounds access within the kernel, enabling code execution or denial of service. Low privileges are sufficient because standard authenticated share access exposes the code path.

No verified proof-of-concept code is publicly available. See the upstream fix commits 18d8db2, 1c9d064, 69f030c, and f0e5c9c for the authoritative patch details.

Detection Methods for CVE-2026-64138

Indicators of Compromise

Unexpected kernel oops or panic traces referencing ksmbd, smb_ntsd, or ACL inheritance functions
SMB sessions creating files with malformed or oversized security descriptors on ksmbd shares
Repeated authentication from unusual clients followed by SMB CREATE operations targeting inherited ACLs

Detection Strategies

Inspect dmesg and journalctl -k for ksmbd warnings, KASAN reports, or slab corruption entries following SMB activity
Enable audit rules on ksmbd share paths to log object creation events and correlate with connecting client identities
Compare running kernel versions against the fixed stable branches identified in the upstream patch commits

Monitoring Recommendations

Aggregate kernel logs from Linux SMB servers into a central SIEM and alert on ksmbd fault signatures
Monitor SMB protocol telemetry for anomalous SET_SECURITY_INFORMATION and CREATE requests with attached security descriptors
Track vulnerability management inventory to confirm that hosts exposing ksmbd receive stable kernel updates promptly

How to Mitigate CVE-2026-64138

Immediate Actions Required

Upgrade to a Linux kernel that includes the smb_validate_ntsd_sid() fix from the referenced stable commits
Restrict SMB share access to trusted, authenticated users and remove guest or anonymous access on ksmbd exports
Segment SMB servers on isolated network zones and block SMB (TCP/445) at the perimeter

Patch Information

The upstream fix is available in the following stable kernel commits: 18d8db2, 1c9d064, 69f030c, and f0e5c9c. Apply the corresponding distribution kernel update and reboot affected hosts.

Workarounds

Unload the ksmbd module (modprobe -r ksmbd) on systems that do not require in-kernel SMB serving and switch to a user-space alternative such as Samba
Blacklist automatic loading of ksmbd in /etc/modprobe.d/ until patched kernels are deployed
Enforce SMB share ACLs at the filesystem layer to limit which authenticated users can create objects that trigger ACL inheritance

bash

# Disable ksmbd until patched kernel is installed
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/disable-ksmbd.conf

# Verify kernel version after patching
uname -r