CVE-2026-64400: Linux Kernel Path Traversal Vulnerability

CVE-2026-64400 Overview

CVE-2026-64400 is a path traversal vulnerability in the Linux kernel's ksmbd in-kernel SMB server. The flaw resides in __ksmbd_vfs_kern_path() and allows authenticated, write-capable SMB users to bypass the LOOKUP_BENEATH restriction that normally confines file operations to the exported share root. When caseless lookup mode is active, the function fails to intercept -EXDEV errors returned by vfs_path_parent_lookup() and falls through to the caseless retry path. Attackers can exploit this to create zero-length files or directories outside the share boundary on the host file system.

Critical Impact
Remote authenticated SMB users can create files or directories outside the exported share, breaking the file-system isolation ksmbd is expected to enforce.

Affected Products

Linux kernel with ksmbd (in-kernel SMB3 server) enabled
Systems exporting SMB shares via ksmbd in caseless (case-insensitive) mode
Stable kernel branches prior to the fixing commits 54bab9ba5a9f and 8c9a4f1327eb

Discovery Timeline

2026-07-25 - CVE-2026-64400 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64400

Vulnerability Analysis

The ksmbd_vfs_path_lookup() function uses the LOOKUP_BENEATH flag to constrain SMB path resolution to the share root. When a crafted path contains parent-directory components such as .. that would escape the share boundary, vfs_path_parent_lookup() correctly detects the escape attempt and returns -EXDEV.

The bug lives in __ksmbd_vfs_kern_path(). Under caseless lookup mode, the function does not distinguish between -ENOENT (file genuinely missing, retry warranted) and -EXDEV (path traversal blocked, retry must not occur). Instead, any lookup failure falls through to the caseless retry logic.

During the retry, the path is reconstructed component by component without re-enforcing LOOKUP_BENEATH. This effectively strips the boundary restriction and lets the traversal succeed. Write-capable SMB users can then create zero-length files or directories at attacker-chosen locations outside the share.

Root Cause

The root cause is overly broad error handling. The caseless retry branch treats every non-success return value as a signal to retry, when it should only retry on -ENOENT. This conflation turns a defense-in-depth error (-EXDEV) into a bypass trigger.

Attack Vector

An attacker requires network access to the SMB service and valid credentials with write permission on any exported share configured for caseless lookup. The attacker sends SMB requests containing paths with .. traversal sequences. The server's boundary check fails but the caseless retry succeeds, resulting in file or directory creation outside the share root. See the upstream fixes at kernel commit 54bab9ba5a9f and kernel commit 8c9a4f1327eb for the corrected error handling.

Detection Methods for CVE-2026-64400

Indicators of Compromise

Unexpected zero-length files or empty directories appearing outside configured ksmbd share roots, particularly in parent directories of the share path.
ksmbd audit or kernel log entries showing SMB CREATE operations with paths containing .. sequences.
File system objects owned by the UID mapped to an SMB service account in locations that account should not be able to write to.

Detection Strategies

Monitor kernel logs for ksmbd path resolution errors and correlate with subsequent successful file creation events.
Enable Linux audit rules on parent directories of exported shares to record create and mkdir syscalls attributable to ksmbd worker threads.
Perform integrity baselining of directories adjacent to SMB export roots and alert on new empty inodes.

Monitoring Recommendations

Ingest kernel and audit logs from SMB servers into a centralized analytics platform to hunt for traversal patterns across the fleet.
Track SMB protocol telemetry for CREATE requests whose file name field contains encoded parent-directory components.
Alert on any modification to files outside declared share roots on hosts running ksmbd.

How to Mitigate CVE-2026-64400

Immediate Actions Required

Update affected Linux kernels to versions that include commits 54bab9ba5a9f156ffa9324fcbe5a356fd0242f95 and 8c9a4f1327eb71efbf14842e7b8a6d965077eb67.
Inventory all Linux hosts running ksmbd and confirm patch status through configuration management tooling.
Audit exported share directories and their parents for anomalous zero-length files or directories created since deployment.

Patch Information

The upstream fix restricts the caseless retry path so it executes only when the lookup returns -ENOENT. Any other error, including -EXDEV from a traversal attempt, is returned immediately to the caller. Apply the stable kernel updates referenced at kernel commit 54bab9ba5a9f and kernel commit 8c9a4f1327eb.

Workarounds

Disable ksmbd and fall back to a user-space SMB server such as Samba until the kernel can be patched.
Restrict SMB share access to authenticated users with read-only permissions where write access is not strictly required.
Segment SMB servers on the network so only trusted client subnets can reach TCP port 445.

bash

# Verify running kernel version and stop ksmbd until patched
uname -r
systemctl stop ksmbd.service
systemctl disable ksmbd.service