https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:35:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64392 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: use opener credentials for delete-on-close</p> <p>Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks.</p> <p>Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user&#39;s fsuid, fsgid, supplementary groups and capability restrictions at final close.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: use opener credentials for delete-on-close</p> <p>Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks.</p> <p>Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user&#39;s fsuid, fsgid, supplementary groups and capability restrictions at final close.</p> https://vulnerability.circl.lu/vuln/cve-2026-64392