CVE-2026-64388: Linux Kernel Privilege Escalation Flaw

CVE-2026-64388 Overview

CVE-2026-64388 is a Linux kernel vulnerability in the smb/client subsystem. The flaw causes ownership (chown) and group (chgrp) modifications to be silently ignored when a filesystem is mounted using SMB3 POSIX Extensions. The issue occurs unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID are also explicitly set at mount time. As a result, expected access-control changes never propagate to the SMB server, leaving files owned by unintended principals. The vulnerability affects the confidentiality, integrity, and availability of files served through the CIFS/SMB client stack on Linux systems.

Critical Impact
Local users can retain unintended ownership over files on SMB3 POSIX mounts because ownership changes issued through chown and chgrp are not enforced on the server.

Affected Products

Linux kernel smb/client (CIFS) subsystem with SMB3 POSIX Extensions enabled
Linux distributions shipping affected mainline and stable kernels prior to the fix
Systems mounting remote shares over SMB3 without CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID

Discovery Timeline

2026-07-25 - CVE-2026-64388 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64388

Vulnerability Analysis

The vulnerability resides in the Linux kernel CIFS client code path that handles attribute updates for files stored on SMB3 shares. When a user issues chown or chgrp against a file on a mount that negotiated SMB3 POSIX Extensions, the client did not translate the UID and GID changes into the corresponding server-side ACL update. The id_mode_to_cifs_acl() mapping was skipped unless the mount was configured with CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID. Applications and administrators receive a successful return from the syscall, but the server retains the previous ownership. This breaks the expected POSIX ownership model and can leave sensitive files accessible to prior owners.

Root Cause

The root cause is a missing branch in cifs_setattr_nounix() that fails to detect the posix_extensions mount condition when updating UID and GID attributes. Because the function does not call id_mode_to_cifs_acl() under that condition, the ownership translation logic is bypassed. The fix adds the posix_extensions check so ownership and group changes are mapped and pushed to the server.

Attack Vector

Exploitation requires local access to a system that has mounted an SMB3 share using POSIX Extensions without the additional ACL-related mount flags. A local user or process performing ownership operations relies on the kernel to enforce them on the remote share. Because the enforcement never reaches the server, files created or owned by one principal remain under that principal despite explicit chown operations by an administrator or automation tool. This undermines least-privilege controls and file segmentation on shared storage.

No public proof-of-concept code is available. Technical details are documented in the upstream Linux kernel commits referenced in the Kernel Git Commit 550cfb8 and Kernel Git Commit 760ef2c.

Detection Methods for CVE-2026-64388

Indicators of Compromise

Files on SMB3 POSIX mounts whose reported ownership on the server does not match the expected UID or GID after administrative chown or chgrp operations.
Audit trail entries showing successful chown/chgrp syscalls that are not reflected in server-side SMB ACL logs.
Mount records in /proc/mounts showing cifs or smb3 mounts using POSIX Extensions without cifsacl or modefromsid options.

Detection Strategies

Compare local stat output on client mounts against server-side ownership reporting to detect divergence.
Enumerate active CIFS mounts and flag those using SMB3 POSIX Extensions without the cifsacl or modefromsid mount options.
Review kernel version inventories to identify hosts running builds that predate the upstream fix commits.

Monitoring Recommendations

Ingest kernel version and mount option telemetry from Linux endpoints into a centralized inventory for continuous drift detection.
Alert on any successful patch-noncompliance across fleet endpoints where SMB3 POSIX mounts are in use.
Correlate file ownership audit events with SMB server ACL logs to identify silent enforcement failures.

How to Mitigate CVE-2026-64388

Immediate Actions Required

Update affected Linux systems to a kernel that includes the upstream commits 550cfb8 and 760ef2c.
Audit all SMB3 mounts and confirm that ownership enforcement behaves as expected after patching.
Restrict administrative access to systems mounting SMB3 POSIX shares until the patched kernel is deployed.

Patch Information

The fix modifies cifs_setattr_nounix() to check for posix_extensions when updating UID and GID, ensuring id_mode_to_cifs_acl() is invoked to map and apply ownership on the server. Refer to Kernel Git Commit 550cfb8 and Kernel Git Commit 760ef2c for the upstream patches. Apply the corresponding distribution kernel update once available.

Workarounds

Mount SMB3 shares with the cifsacl or modefromsid options so id_mode_to_cifs_acl() is triggered on ownership changes.
Avoid enabling SMB3 POSIX Extensions on shares where UID/GID enforcement is required until the kernel is patched.
Enforce ownership policies at the SMB server side to compensate for the missing client-side translation.

bash

# Configuration example: remount SMB3 share with cifsacl to force ownership enforcement
mount -t cifs //server/share /mnt/share \
  -o vers=3.1.1,cifsacl,uid=1000,gid=1000,credentials=/etc/smb.creds