CVE-2026-64394: Linux Kernel Privilege Escalation Flaw

CVE-2026-64394 Overview

CVE-2026-64394 is a permission bypass vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The smb2_set_info_sec() handler calls set_info_sec() without verifying that the file handle carries WRITE_DAC or WRITE_OWNER access rights. A remote authenticated client can open a handle with only FILE_WRITE_ATTRIBUTES and issue an SMB2_SET_INFO request with InfoType SMB2_O_INFO_SECURITY to rewrite the file's Discretionary Access Control List (DACL) and owner. This grants the client access the handle was never authorized to hold, resulting in a broken access control condition on any share exported by ksmbd.

Critical Impact
An authenticated SMB client can rewrite file DACLs and ownership without holding WRITE_DAC or WRITE_OWNER, enabling privilege escalation to full read/write control over targeted files.

Affected Products

Linux kernel ksmbd (in-kernel SMB3 server) — versions containing smb2_set_info_sec() without the WRITE_DAC/WRITE_OWNER gate
Distributions shipping vulnerable kernels with CONFIG_SMB_SERVER enabled
SMB shares exported with KSMBD_SHARE_FLAG_ACL_XATTR are particularly exposed because the Windows security descriptor xattr is also rewritten

Discovery Timeline

2026-07-25 - CVE-2026-64394 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64394

Vulnerability Analysis

The flaw resides in fs/smb/server/smb2pdu.c where smb2_set_info_sec() dispatches to set_info_sec() in fs/smb/server/smbacl.c. The sibling handler smb2_set_info_file() gates every persistent-mutation arm with a check on fp->daccess, requiring rights such as FILE_WRITE_DATA, FILE_DELETE, FILE_WRITE_EA, or FILE_WRITE_ATTRIBUTES before mutating file state. The SECURITY arm skipped this check entirely.

Once invoked, set_info_sec() re-permissions the target file through three operations. It rewrites owner, group, and mode via notify_change(), updates the POSIX Access Control List (ACL) via set_posix_acl(), and, on shares with KSMBD_SHARE_FLAG_ACL_XATTR, removes and rewrites the Windows security descriptor xattr through ksmbd_vfs_set_sd_xattr(). Because this is a metadata and xattr operation, no FMODE_WRITE VFS backstop applies. The missing handle-level check is the only gate.

Root Cause

The root cause is missing authorization on a handle-level operation, a Broken Access Control condition. A prior fix (commit cc57232cae23) added a fp->daccess check to fsctl_set_sparse and acknowledged that similar checks were missing elsewhere. The SET_INFO SECURITY path is the highest-impact instance because it mutates the access control model itself.

Attack Vector

An authenticated client connects to a ksmbd share and opens a target file requesting only FILE_WRITE_ATTRIBUTES. The client then sends an SMB2_SET_INFO request with InfoType set to SMB2_O_INFO_SECURITY and supplies a self-authored security descriptor that grants full control to the attacker's SID. The server writes the new DACL, owner, and mode without validating that the handle carries WRITE_DAC or WRITE_OWNER. Subsequent opens by the attacker succeed with the elevated rights.

The upstream patch adds a check that requires at least one of FILE_WRITE_DAC or FILE_WRITE_OWNER on fp->daccess before proceeding, returning -EACCES (mapped to STATUS_ACCESS_DENIED) when neither is present. See the Kernel Patch 0848b1d for the reference implementation.

Detection Methods for CVE-2026-64394

Indicators of Compromise

Unexpected changes to file owner, group, mode, or POSIX ACLs on files served by ksmbd, particularly when the requesting session did not previously hold administrative rights.
Modifications to the security.NTACL extended attribute on shares configured with KSMBD_SHARE_FLAG_ACL_XATTR.
SMB2 SET_INFO requests with InfoType = 0x03 (SECURITY) originating from sessions whose opens requested only FILE_WRITE_ATTRIBUTES (0x00000100).

Detection Strategies

Enable kernel audit rules on files under ksmbd-exported paths to log chown, chmod, and setxattr events with the invoking process and remote session context.
Capture SMB traffic and alert on SMB2 SET_INFO frames where InfoType == SMB2_O_INFO_SECURITY correlate with prior CREATE responses lacking WRITE_DAC/WRITE_OWNER in DesiredAccess.
Compare baseline file ownership and DACL snapshots on exported shares against periodic scans to identify unauthorized re-permissioning.

Monitoring Recommendations

Forward ksmbd server logs and Linux audit events to a centralized data lake for correlation across sessions and hosts.
Track authentication events for SMB users and correlate anomalous SET_INFO SECURITY operations with source IP and session ID.
Alert on any successful ownership change to files owned by privileged accounts (root, service accounts) initiated over SMB.

How to Mitigate CVE-2026-64394

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the CVE and reboot affected hosts running ksmbd.
Inventory all Linux systems exporting SMB shares via ksmbd and prioritize patching those with KSMBD_SHARE_FLAG_ACL_XATTR enabled.
Audit file ownership and ACLs on exported shares to identify any unauthorized modifications that predate patching.

Patch Information

The fix adds a WRITE_DAC/WRITE_OWNER handle-level check to smb2_set_info_sec() before calling set_info_sec(). Stable kernel patches are available at Kernel Patch 0848b1d, Kernel Patch 44df157, Kernel Patch 9ab2ffd, Kernel Patch aae600c, Kernel Patch e6aa731, and Kernel Patch f56535d.

Workarounds

Unload the ksmbd kernel module (modprobe -r ksmbd) and migrate SMB service to a patched or alternative server (for example, Samba smbd) until the kernel can be updated.
Restrict network access to SMB ports (TCP/445) using host firewalls so that only trusted client subnets can reach ksmbd.
Disable KSMBD_SHARE_FLAG_ACL_XATTR on affected shares to reduce the blast radius by preventing rewrite of the Windows security descriptor xattr.
Require strong authentication and disable guest access on all ksmbd shares to raise the bar for an attacker needing an authenticated session.