CVE-2026-64379: Linux Kernel Privilege Escalation Flaw

CVE-2026-64379 Overview

CVE-2026-64379 is a vulnerability in the Linux kernel's SMB client subsystem. When the modefromsid mount option is active, the parse_dacl() function applies the server-provided sub_auth[2] value from the NFS mode SID directly to cf_mode without masking it to 07777. A malicious or compromised SMB server can supply crafted mode bits that fall outside the expected permission range, causing incorrect file mode representation on the client. The fix applies the same masking used on the read path, restricting the value to valid permission bits.

Critical Impact
A malicious SMB server can influence file mode bits on the client, leading to integrity issues and potential availability impact on Linux systems mounting shares with modefromsid.

Affected Products

Linux kernel SMB client (fs/smb/client)
Systems mounting SMB/CIFS shares with the modefromsid option
Multiple stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64379 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64379

Vulnerability Analysis

The Linux kernel SMB client supports the modefromsid mount option, which derives UNIX file mode bits from a special NFS mode Security Identifier (SID) provided by the server. Inside parse_dacl(), the client reads the sub_auth[2] component of that SID and assigns it to the inode's cf_mode field. The read path correctly masks this value to 07777, which represents the valid UNIX permission bits including setuid, setgid, and sticky bits. The write path in parse_dacl() omitted this mask, allowing bits above 07777 to propagate into cf_mode.

This creates an inconsistency between the client's stored mode and the values a UNIX filesystem should permit. Because the SID data originates from the SMB server, any server the client trusts enough to mount can inject arbitrary high-order bits into permission fields, corrupting file metadata state.

Root Cause

The root cause is missing input sanitization on server-supplied data. The parse_dacl() function assigned sub_auth[2] to cf_mode without applying the & 07777 mask used elsewhere in the code path. This is a classic improper input validation issue where symmetric masking was applied inconsistently across two code paths handling the same data.

Attack Vector

Exploitation requires a Linux client to mount an SMB share with the modefromsid option from an attacker-controlled or compromised server. The attack requires user interaction in the form of the mount operation. Once mounted, the malicious server returns crafted NFS mode SIDs with sub_auth[2] values containing bits above the valid 07777 range. The client stores these unmasked values, producing incorrect mode state that can affect subsequent permission handling and kernel behavior.

Refer to the upstream commits for the exact code changes, including commit c6c484a7d5bf and commit f80add1bfb34.

Detection Methods for CVE-2026-64379

Indicators of Compromise

SMB mounts using the modefromsid option targeting untrusted or externally reachable servers
Files on SMB shares presenting mode values with bits set above 07777 in kernel structures or audit output
Unexpected kernel log entries from the cifs or smb client subsystem referencing DACL parsing

Detection Strategies

Inventory Linux hosts and identify any /etc/fstab entries or mount.cifs invocations that include modefromsid
Audit running kernel versions against the fixed versions referenced in the upstream stable commits
Monitor SMB server endpoints reached by clients using modefromsid and correlate against expected trust boundaries

Monitoring Recommendations

Enable kernel audit logging for mount syscalls involving the cifs filesystem type
Track outbound SMB sessions from Linux hosts to identify unauthorized server destinations
Alert on new or modified mount.cifs command lines that add the modefromsid option

How to Mitigate CVE-2026-64379

Immediate Actions Required

Apply the upstream kernel patches from the referenced git.kernel.org stable commits to all affected Linux systems
Restrict use of the modefromsid mount option to shares served by trusted, authenticated SMB servers
Rebuild and redeploy custom kernels that carry the fs/smb/client subsystem changes

Patch Information

The fix applies the & 07777 mask to the server-provided sub_auth[2] value in parse_dacl(), matching the sanitization already present on the read path. Patches are available across multiple stable branches. See the Linux kernel stable commit and the additional stable backports linked in the CVE references for branch-specific fixes.

Workarounds

Remove the modefromsid option from SMB mount configurations where it is not strictly required
Limit SMB client connectivity to internal, trusted file servers using network segmentation or firewall rules
Use alternative permission-mapping mechanisms such as uid, gid, and file_mode options when feasible

bash

# Configuration example: remove modefromsid from an existing SMB mount
# /etc/fstab before
# //fileserver/share  /mnt/share  cifs  credentials=/etc/smb-creds,modefromsid  0 0

# /etc/fstab after (safer alternative until patched)
//fileserver/share  /mnt/share  cifs  credentials=/etc/smb-creds,uid=1000,gid=1000,file_mode=0644,dir_mode=0755  0 0

# Verify the running kernel version after patching
uname -r