CVE-2026-64393: Linux Kernel Privilege Escalation Flaw

CVE-2026-64393 Overview

CVE-2026-64393 is a vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw affects how SMB2 SET_INFO handlers perform permission checks when modifying file metadata. Path-based Virtual File System (VFS) helpers invoked by these handlers relied on the current ksmbd worker thread credentials instead of the credentials captured when the SMB handle was opened. This mismatch allows privilege and access checks to be evaluated against the wrong security context.

The vulnerability affects Linux kernel builds that ship ksmbd with network-exposed SMB shares. Remote attackers with SMB access can leverage the flaw to bypass owner, inode permission, and Linux Security Module (LSM) checks.

Critical Impact
Remote attackers authenticated to an SMB share can modify file metadata using credentials different from those authorized at handle open, resulting in integrity and availability compromise.

Affected Products

Linux kernel with ksmbd SMB server module enabled
Distributions shipping affected mainline and stable kernel branches referenced in the upstream fix commits
Systems exposing SMB2/SMB3 shares via ksmbd to untrusted networks

Discovery Timeline

2026-07-25 - CVE-2026-64393 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64393

Vulnerability Analysis

The vulnerability resides in the ksmbd SMB2 SET_INFO command dispatch path. When a client issues a SET_INFO request, ksmbd validates the access mask granted to the SMB handle before calling path-based VFS helpers to apply the requested change. These helpers include operations for renaming, linking, changing ownership, and modifying security descriptors.

The helpers internally perform owner, inode permission, and LSM checks. Those checks consult current_cred(), which returns the credentials of the ksmbd worker kernel thread rather than the credentials of the user who opened the handle. As a result, VFS-level authorization runs under the wrong security principal, undermining the mapping between SMB session identity and Linux file-permission enforcement.

The upstream fix wraps the entire SET_INFO dispatch in an override_creds() scope using the credentials captured at handle open. This consolidates all SET_INFO classes, including security-information updates, under a single credential context that matches the authenticated SMB user.

Root Cause

The root cause is improper access control [CWE-284] combined with an incorrect security context during VFS operations. The SET_INFO handlers assumed the worker thread's credentials matched the handle owner's credentials. This assumption was invalid because ksmbd worker threads run under a service-wide credential context, not per-connection user credentials.

Attack Vector

An attacker with network access to an SMB share exposed by ksmbd opens a handle to a target file. The attacker then issues SET_INFO requests to alter file attributes, rename entries, adjust ownership, or modify security descriptors. Because VFS helpers evaluate permissions using worker-thread credentials, the attacker can drive filesystem changes that should have been denied under the SMB session's authenticated identity.

The vulnerability does not require user interaction and is exploitable over the network against any reachable ksmbd share. Detailed root-cause commentary is available in the upstream fix commits, including Kernel Git Commit b383bca and Kernel Git Commit 0ce6828.

Detection Methods for CVE-2026-64393

Indicators of Compromise

Unexpected SET_INFO operations against sensitive files logged by SMB audit tooling or ksmbd debug logs
File ownership, mode, or extended attribute changes that do not correspond to legitimate administrative activity
Renames, hard links, or security descriptor updates performed by SMB sessions whose authenticated user should lack the required permissions

Detection Strategies

Enable kernel audit rules on chown, chmod, setxattr, rename, and link syscalls to correlate VFS changes with the originating ksmbd worker process
Compare SMB session user identities against resulting filesystem metadata changes to detect authorization drift
Monitor ksmbd module version and kernel release against the fixed commits listed in the upstream references

Monitoring Recommendations

Forward ksmbd and auditd events to a centralized logging platform for correlation across SMB sessions and filesystem changes
Alert on file metadata modifications outside of change windows on shares exposing sensitive data
Track network connections to TCP port 445 from unexpected source ranges terminating on hosts running ksmbd

How to Mitigate CVE-2026-64393

Immediate Actions Required

Update the Linux kernel to a version containing the fix commits referenced by the upstream advisory
Restrict network access to ksmbd shares using host firewalls and network segmentation until patching is complete
Audit ksmbd share configurations to remove unnecessary write, delete, or attribute-change permissions

Patch Information

The fix is delivered by the upstream ksmbd maintainers across multiple stable branches. Apply the kernel update that includes the commits at Kernel Git Commit b383bca, Kernel Git Commit 0ce6828, Kernel Git Commit 20ee516, Kernel Git Commit 5cbabf3, Kernel Git Commit 8cc9ec7, and Kernel Git Commit b35afd5. The patch wraps SET_INFO dispatch with override_creds() using the opener's credentials.

Workarounds

Disable the ksmbd kernel module on hosts that do not require in-kernel SMB serving and use a userspace SMB server such as Samba as an interim measure
Block inbound TCP port 445 at the network perimeter and restrict access to trusted management subnets
Mount exported filesystems read-only where write access is not required, reducing the surface for SET_INFO abuse

bash

# Temporarily unload ksmbd until the patched kernel is deployed
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd

# Block SMB from untrusted networks with nftables
sudo nft add rule inet filter input tcp dport 445 drop