CVE-2026-64392: Linux Kernel Auth Bypass Vulnerability

CVE-2026-64392 Overview

CVE-2026-64392 is a Linux kernel vulnerability in the ksmbd in-kernel SMB3 server. Delete-on-close operations can complete during deferred or durable handle teardown, when no request work context is available. In that path, both the base-file unlink and the Alternate Data Stream (ADS) xattr removal execute with the ksmbd worker's credentials rather than the opener's. This lets the operations bypass filesystem permission checks that would normally apply to the authenticated SMB user.

The fix runs both operations with the credentials captured in struct file at open time, preserving the authenticated user's fsuid, fsgid, supplementary groups, and capability restrictions at final close.

Critical Impact
A remote authenticated SMB client can trigger deletion of files and extended attributes that the user should not be permitted to remove, resulting in unauthorized data destruction on ksmbd-exported shares.

Affected Products

Linux kernel builds with ksmbd (in-kernel SMB3 server) enabled
Distributions shipping vulnerable stable kernel branches referenced in the upstream fix commits
Systems exposing SMB shares over the network via ksmbd

Discovery Timeline

2026-07-25 - CVE-2026-64392 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64392

Vulnerability Analysis

The ksmbd server implements SMB2/3 delete-on-close semantics, where a file marked for deletion is removed when its final handle closes. In normal request-driven closes, the ksmbd worker performs the unlink in the context of the requesting session, so filesystem checks apply against the authenticated user.

However, delete-on-close can also complete through deferred close or durable handle teardown paths. These paths execute asynchronously from any client request, and no request work structure is present. As a result, the base-file unlink and the ADS xattr removal both ran using the ksmbd kernel worker's credentials, effectively running as a privileged kernel context.

Because the kernel worker is not subject to the authenticated user's fsuid, fsgid, supplementary groups, or capability restrictions, the resulting VFS calls bypass discretionary access controls (DAC) and POSIX ACL checks. A client that holds a handle with delete-on-close set can then cause file deletions that would have failed under normal permission checks.

Root Cause

The root cause is missing credential propagation between handle-open time and asynchronous handle teardown. The struct file opened by the authenticated user carries the correct credentials, but the deferred and durable teardown paths dispatched unlink and xattr removal without switching to those saved credentials. Fixed builds now execute both operations under the credentials captured in struct file at open, restoring correct permission enforcement at final close.

Attack Vector

An attacker with network access to a ksmbd share and a valid authenticated session opens a target file, sets the delete-on-close disposition, and closes the handle in a way that routes cleanup through the deferred or durable path. The subsequent unlink runs with worker credentials, so files or ADS xattrs that the user could open but not delete under normal DAC checks are removed. The vector applies to both the base file and Alternate Data Streams associated with the object.

No public proof-of-concept exploit is currently listed for this CVE. Technical details are documented in the upstream stable-tree commits, including commit 18c59109 and commit f08b3f45.

Detection Methods for CVE-2026-64392

Indicators of Compromise

Unexpected file or directory deletions on ksmbd-exported shares performed by SMB users who lack DAC permissions to remove them.
Removal of Alternate Data Streams (extended attributes) from files owned by other users on ksmbd shares.
SMB session activity showing repeated open, set-delete-disposition, and close sequences against files owned by other users.

Detection Strategies

Enable Linux audit rules on unlink, unlinkat, removexattr, and fremovexattr syscalls originating from the ksmbd kernel worker threads, and correlate with the active SMB session owner.
Monitor kernel logs for ksmbd messages related to deferred close and durable handle teardown coinciding with file deletion events.
Compare file ownership against the authenticated SMB user for any delete events sourced from ksmbd to identify permission bypasses.

Monitoring Recommendations

Ingest kernel audit logs and SMB session telemetry into a centralized analytics platform and alert on delete operations where the file owner does not match the authenticated SMB principal.
Track kernel version and patch status of all Linux hosts exporting SMB shares via ksmbd to detect drift from fixed builds.
Baseline expected delete-on-close activity per share and alert on volumetric anomalies against sensitive directories.

How to Mitigate CVE-2026-64392

Immediate Actions Required

Update the Linux kernel to a stable release that incorporates the fix commits referenced in the NVD entry for CVE-2026-64392.
If patching is not immediately possible, disable ksmbd on affected hosts and route SMB serving through a patched alternative until fixed kernels are deployed.
Restrict network access to SMB (TCP/445) on ksmbd hosts to trusted management ranges only, reducing exposure to authenticated attackers.

Patch Information

The fix is available in Linux stable branches through the following upstream commits: 18c59109bb6f, 4b7059974549, 52e2f2191115, e72c15085b6d, and f08b3f451f12. The patch changes delete-on-close teardown to use credentials captured in struct file at open time so that fsuid, fsgid, supplementary groups, and capabilities of the authenticated user are enforced at final close.

Workarounds

Unload the ksmbd kernel module (modprobe -r ksmbd) on hosts that do not require in-kernel SMB serving.
Migrate SMB workloads to a userspace SMB server on affected hosts until the kernel is updated.
Tighten share-level permissions and directory-level ACLs so that authenticated users cannot open sensitive files with delete-on-close disposition.

bash

# Configuration example: verify running kernel and disable ksmbd until patched
uname -r
systemctl stop ksmbd.service 2>/dev/null || true
systemctl disable ksmbd.service 2>/dev/null || true
modprobe -r ksmbd

# Block SMB from untrusted networks at the host firewall
nft add rule inet filter input tcp dport 445 drop