CVE-2026-64391 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: use opener credentials for ADS I/O
Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the current task credentials.
Run ADS I/O with the credentials captured when the SMB handle was opened.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in question affects the linux kernel's ksmbd implementation and relates to how alternate data streams are handled during smb file operations. This issue stems from a fundamental mismatch in credential handling between regular file I/O operations and alternate data stream access patterns within the smb protocol implementation. The problem manifests when processing alternate data streams which are stored as extended attributes on the filesystem, creating a unique operational context that differs significantly from standard file access methods.
The technical flaw occurs because alternate data streams utilize the VFS xattr helper functions for read and write operations rather than the conventional file I/O pathways. This design choice necessitates additional security checks through the VFS layer where inode permissions and Linux Security Module policies are reevaluated using the current task credentials instead of the original opener credentials. The consequence is that when a user opens an smb handle to access a file, subsequent alternate data stream operations may execute with different effective privileges than those originally granted, potentially allowing privilege escalation or unauthorized access to protected resources.
This vulnerability has significant operational impact within enterprise environments that rely on smb file sharing and ksmbd implementations for cross-platform file access. The flaw creates an attack surface where malicious actors could exploit the credential mismatch to gain elevated privileges or access restricted data through carefully crafted alternate data stream operations. The risk is particularly pronounced in multi-user environments where strict access controls are expected but may be bypassed due to the improper credential handling during alternate data stream I/O operations.
The fix addresses this by ensuring that alternate data stream I/O operations execute with the same credentials captured when the SMB handle was originally opened, maintaining consistency between the initial authorization context and subsequent operations on the same file handle. This approach aligns with security best practices for maintaining consistent privilege contexts throughout the lifecycle of file access operations. The solution follows established principles from CWE category 284 which addresses improper access control, and addresses techniques from ATT&CK matrix domain 315 related to privilege escalation through credential manipulation.
The implementation change ensures that when alternate data streams are accessed through the VFS xattr helpers, the security checks occur using the original opener credentials rather than the current task context, thereby preserving the intended authorization boundaries established during the initial smb handle creation. This modification maintains the security model integrity while preserving functional compatibility with existing smb client implementations and alternate data stream functionality. The fix represents a targeted approach to credential management that prevents unauthorized privilege escalation through improper credential handling in extended attribute operations.