CVE-2026-64391 (GCVE-0-2026-64391)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
Title
ksmbd: use opener credentials for ADS I/O
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the current task credentials. Run ADS I/O with the credentials captured when the SMB handle was opened.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f44158485826c076335d6860d35872271a83791d , < a8f5d39971bbad9340d49cd41b0e2da9452a649d (git)
Affected: f44158485826c076335d6860d35872271a83791d , < 2b4592cea214683de0f2ce6f8c22c097fb0ea1ab (git)
Affected: f44158485826c076335d6860d35872271a83791d , < 52a56cf53ec834c44ac1b4d16d585f26613ee5ce (git)
Affected: f44158485826c076335d6860d35872271a83791d , < baa5e094886fffa7e6272edcb5e08be5ce28262c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8f5d39971bbad9340d49cd41b0e2da9452a649d",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "2b4592cea214683de0f2ce6f8c22c097fb0ea1ab",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "52a56cf53ec834c44ac1b4d16d585f26613ee5ce",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "baa5e094886fffa7e6272edcb5e08be5ce28262c",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for ADS I/O\n\nAlternate data streams are stored as xattrs. Unlike regular file I/O,\ntheir read and write paths therefore call VFS xattr helpers which recheck\ninode permissions and LSM policy using the current task credentials.\n\nRun ADS I/O with the credentials captured when the SMB handle was opened."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An attacker reaches the vulnerable ADS read and write paths through SMB2 requests to an exposed ksmbd server over TCP/445.\nAC:L - Exploitation is deterministic using an ADS handle followed by ordinary SMB2 READ or WRITE requests; no race, memory-layout dependency, or condition outside the attacker\u0027s control is required.\nPR:N - Although a valid session, tree connection, and handle are required, a guest-enabled streams share permits a remote client to establish the necessary guest session without supplying valid credentials.\nUI:N - The attacker directly opens and accesses the alternate data stream through SMB requests without requiring any victim action.\nS:U - The credential bypass affects ADS data managed by the same host kernel and filesystem security authority; it does not cross a virtualization or comparable isolation boundary.\nC:H - Privileged worker credentials can bypass inode and LSM xattr checks and disclose the complete contents of an attacker-selected named stream, including potentially sensitive application data.\nI:H - The vulnerable write path can bypass xattr authorization and replace or truncate the complete named stream with attacker-controlled data.\nA:H - Repeated unauthorized truncation or corruption can persistently destroy an ADS and render applications or services that depend on that stream unusable until the data is restored."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:43.832Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8f5d39971bbad9340d49cd41b0e2da9452a649d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b4592cea214683de0f2ce6f8c22c097fb0ea1ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/52a56cf53ec834c44ac1b4d16d585f26613ee5ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/baa5e094886fffa7e6272edcb5e08be5ce28262c"
        }
      ],
      "title": "ksmbd: use opener credentials for ADS I/O",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64391",
    "datePublished": "2026-07-25T08:50:38.013Z",
    "dateReserved": "2026-07-19T15:36:31.785Z",
    "dateUpdated": "2026-08-17T04:54:43.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64391",
      "date": "2026-09-21",
      "epss": "0.00457",
      "percentile": "0.38847"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:42:15.000Z",
      "cve": "CVE-2026-64391",
      "id": "msrc_CVE-2026-64391",
      "initial_release_date": "2026-07-26T01:11:39.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: use opener credentials for ADS I/O",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64391.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/vfs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a8f5d39971bbad9340d49cd41b0e2da9452a649d",
                    "status": "affected",
                    "version": "f44158485826c076335d6860d35872271a83791d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b4592cea214683de0f2ce6f8c22c097fb0ea1ab",
                    "status": "affected",
                    "version": "f44158485826c076335d6860d35872271a83791d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "52a56cf53ec834c44ac1b4d16d585f26613ee5ce",
                    "status": "affected",
                    "version": "f44158485826c076335d6860d35872271a83791d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "baa5e094886fffa7e6272edcb5e08be5ce28262c",
                    "status": "affected",
                    "version": "f44158485826c076335d6860d35872271a83791d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/vfs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5E43E3CF-BCD1-4C3F-B23D-AF6EAE0FA079",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for ADS I/O\n\nAlternate data streams are stored as xattrs. Unlike regular file I/O,\ntheir read and write paths therefore call VFS xattr helpers which recheck\ninode permissions and LSM policy using the current task credentials.\n\nRun ADS I/O with the credentials captured when the SMB handle was opened."
          }
        ],
        "id": "CVE-2026-64391",
        "lastModified": "2026-09-04T19:08:24.653",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:22.453",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2b4592cea214683de0f2ce6f8c22c097fb0ea1ab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/52a56cf53ec834c44ac1b4d16d585f26613ee5ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a8f5d39971bbad9340d49cd41b0e2da9452a649d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/baa5e094886fffa7e6272edcb5e08be5ce28262c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-29T17:29:09+00:00",
      "cve": "CVE-2026-64391",
      "id": "CVE-2026-64391",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: use opener credentials for ADS I/O",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64391.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:50:15Z",
      "cve": "CVE-2026-64391",
      "id": "CVE-2026-64391",
      "initial_release_date": "2026-07-25T16:00:13Z",
      "product_status:known_affected": "125",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64391",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64391.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.