PT-2026-64614 · Linux · Linux

CVE-2026-64393 · Published 2026-07-25 · Updated 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: run set info with opener credentials

SMB2 SET INFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the current ksmbd worker credentials.

Run the complete SET INFO dispatch with the credentials captured when the handle was opened. This also removes the separate security information credential setup and keeps all SET INFO classes under one credential scope.

Direct override creds() is used because it can nest with the request credential overrides already used by rename and link helpers.

Related Identifiers

CVE-2026-64393

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64393 · Security Note
• https://git.kernel.org/stable/c/5cbabf3a71575cd31bc7785d92d4ab42338a654b · Note
• https://git.kernel.org/stable/c/20ee516a62989a8d505ee432f9e59525ea23984e · Note
• https://git.kernel.org/stable/c/0ce682867fd506f61f40c76bde7e4205bde34e87 · Note
• https://git.kernel.org/stable/c/b35afd5cf8fab236ef21117e42ee45691d4ffa7b · Note
• https://git.kernel.org/stable/c/8cc9ec711f5255167247a9ab6a7179b787426ed7 · Note
• https://git.kernel.org/stable/c/b383bcad3d2fe634b26efbce53e22bbb5753a520 · Note