CVE-2026-64379 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: mask server-provided mode to 07777 in modefromsid
When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to
07777. Apply the correct masking, same as in the read path.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within the Linux kernel's SMB client implementation where improper handling of file permissions can lead to privilege escalation and unauthorized access. The issue specifically affects how the kernel processes Security Identifier (SID) values when translating server-provided file modes into local filesystem permissions. When the modefromsid feature is enabled, the parse_dacl() function processes the sub_auth[2] value from NFS mode SIDs but fails to properly mask this value to 07777 before applying it to the cf_mode variable. This oversight creates a potential security exposure where malicious servers could provide crafted permission values that bypass normal access controls.
The technical flaw stems from inconsistent handling of permission bits between different code paths within the SMB client subsystem. While the read path correctly applies the 07777 mask to limit permissions to valid octal values, the write path in parse_dacl() omits this crucial masking step. This discrepancy allows for potential exploitation where server-provided mode values could contain invalid or excessive permission bits that would otherwise be filtered out. The vulnerability represents a classic case of insufficient input validation and inconsistent security checking across different code execution paths.
The operational impact of this vulnerability extends beyond simple permission mismanagement to potentially enable unauthorized file access and modification. An attacker controlling a malicious SMB server could exploit this weakness to grant excessive permissions to files or directories, effectively bypassing the normal filesystem permission model. This could lead to privilege escalation scenarios where regular users gain elevated access rights, or where system administrators inadvertently expose sensitive data through malformed permission attributes. The vulnerability affects systems running Linux kernels with SMB client support and could be particularly dangerous in enterprise environments where file sharing protocols are extensively used.
Mitigation strategies should focus on applying the appropriate kernel patches that ensure consistent masking behavior across all code paths handling SID-based permissions. System administrators should prioritize updating their kernel versions to include the fixed implementation where modefromsid consistently applies the 07777 mask to prevent unauthorized permission escalation. Additionally, monitoring for unusual permission changes in SMB-mounted filesystems can help detect potential exploitation attempts. The fix aligns with security best practices outlined in CWE-1234 related to improper access control and demonstrates proper defensive programming techniques that maintain consistency between read and write operations in security-sensitive code sections.
This vulnerability classification maps to ATT&CK technique T1068 which involves exploiting legitimate credentials for privilege escalation, and more specifically relates to credential abuse within the context of file system permissions. The weakness exists in the kernel's SMB client implementation where proper access control enforcement fails due to inconsistent masking operations, potentially allowing attackers to manipulate file permissions beyond normal boundaries. The fix addresses this by ensuring that all permission values are properly constrained to valid ranges before being applied to local filesystem attributes, maintaining the integrity of the underlying security model.