CVE-2026-64391: Linux Kernel Privilege Escalation Flaw

CVE-2026-64391 Overview

CVE-2026-64391 is a Linux kernel vulnerability in the ksmbd in-kernel SMB3 server. The flaw affects how Alternate Data Streams (ADS) I/O operations handle credentials during read and write paths. ADS are stored as extended attributes (xattrs), so their I/O paths invoke VFS xattr helpers. These helpers recheck inode permissions and Linux Security Module (LSM) policy using the current task credentials rather than the credentials of the user who opened the SMB handle. An attacker with network access to an exposed ksmbd share can potentially bypass access controls by exploiting this credential mismatch.

Critical Impact
A network-adjacent attacker can bypass permission and LSM policy checks during ADS read and write operations on ksmbd shares, leading to unauthorized data access or modification.

Affected Products

Linux kernel with ksmbd SMB server enabled
Systems exposing SMB shares via the in-kernel ksmbd service
Distributions shipping vulnerable kernel versions prior to the fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64391 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64391

Vulnerability Analysis

The vulnerability resides in the ksmbd kernel module, which implements SMB3 file sharing inside the Linux kernel. Alternate Data Streams (ADS) provide a way for SMB clients to store additional metadata streams alongside a primary file. On Linux, ksmbd maps these streams to extended attributes (xattrs).

Unlike regular file I/O, which operates on an open file descriptor whose credentials were validated at open time, ADS read and write operations traverse VFS xattr helpers. These helpers perform their own inode permission checks and consult the active LSM policy using the credentials of the task currently executing the operation, not those of the user who originally opened the SMB handle.

This mismatch allows an attacker to leverage the credential context of a kernel worker thread or a differently-privileged session to perform ADS operations that should have been denied.

Root Cause

The root cause is a credential context mismatch [Broken Access Control]. ksmbd did not apply the opener's credentials when invoking VFS xattr helpers for ADS I/O. Because xattr helpers reevaluate permission and LSM policy at call time, the checks were performed against the wrong security context, bypassing the intended authorization boundary established at SMB handle open.

Attack Vector

The vulnerability is exploitable over the network with no authentication or user interaction required. An attacker who can send SMB traffic to a ksmbd server can trigger ADS read or write operations that execute VFS xattr helpers under credentials that differ from the SMB opener. The upstream fix, applied in kernel commits 2b4592c, 52a56cf, a8f5d39, and baa5e09, wraps ADS I/O so that it runs with the credentials captured when the SMB handle was opened.

See the Kernel Git Commit 2b4592c and Kernel Git Commit baa5e09 for the patch series.

Detection Methods for CVE-2026-64391

Indicators of Compromise

Unexpected SMB sessions accessing alternate data streams (::$DATA suffixed paths) against ksmbd shares
Extended attribute modifications on files where the connecting SMB user should lack write permission
Audit records showing setxattr or getxattr operations originating from ksmbd kernel worker threads on unexpected inodes

Detection Strategies

Enable Linux audit rules on setxattr, getxattr, removexattr, and listxattr syscalls for filesystems exported via ksmbd
Correlate SMB session authentication events with subsequent xattr activity to identify credential mismatches
Monitor kernel logs for ksmbd module activity and unexpected error codes on ADS operations

Monitoring Recommendations

Inventory all Linux hosts with the ksmbd module loaded and confirm running kernel versions
Alert on new inbound SMB connections to hosts not previously acting as file servers
Track LSM policy denials (AppArmor, SELinux) that reference ksmbd kernel threads for anomalous access patterns

How to Mitigate CVE-2026-64391

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 2b4592c, 52a56cf, a8f5d39, and baa5e09 as soon as vendor-packaged kernels become available
Restrict network exposure of ksmbd services to trusted management networks using host and network firewalls
Audit ksmbd share configurations to enforce least-privilege access and disable anonymous or guest access

Patch Information

The fix updates ksmbd to execute ADS I/O with the credentials captured when the SMB handle was opened, ensuring VFS xattr helpers evaluate permission and LSM policy against the correct security context. Patches are available in the mainline and stable kernel trees via Kernel Git Commit 52a56cf and Kernel Git Commit a8f5d39. Consult your distribution's security advisories for backported packages.

Workarounds

Unload the ksmbd kernel module (modprobe -r ksmbd) on hosts that do not require SMB file sharing
Migrate SMB workloads temporarily to a userspace SMB server such as Samba until patched kernels are deployed
Block TCP port 445 at the perimeter and internal segmentation points to limit reachability of ksmbd endpoints

bash

# Disable and blacklist the ksmbd kernel module
sudo systemctl stop ksmbd.service 2>/dev/null
sudo modprobe -r ksmbd
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Block inbound SMB at the host firewall
sudo iptables -A INPUT -p tcp --dport 445 -j DROP