CVE-2026-64393 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: run set info with opener credentials
SMB2 SET_INFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the current ksmbd worker credentials.
Run the complete SET_INFO dispatch with the credentials captured when the handle was opened. This also removes the separate security information credential setup and keeps all SET_INFO classes under one credential scope.
Direct override_creds() is used because it can nest with the request credential overrides already used by rename and link helpers.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in question pertains to a privilege escalation issue within the Linux kernel's ksmbd implementation, specifically affecting SMB2 SET_INFO operations. This flaw arises from improper credential handling during file information modification operations, creating a potential security vector that could allow unauthorized users to escalate their privileges within the SMB filesystem context. The issue is particularly significant because it affects the core authentication and authorization mechanisms that govern file access in networked storage environments.
The technical root cause lies in how ksmbd processes SET_INFO requests through its SMB2 protocol implementation. When handling these operations, the system initially validates access permissions against the SMB handle's granted access mask before proceeding to execute path-based VFS helpers. However, these VFS helpers perform critical security checks including owner verification, inode permission validation, and Linux Security Module assessments using the current ksmbd worker process credentials rather than the original credentials associated with the file handle at the time of opening. This credential mismatch creates a window where malicious actors could potentially exploit the system's security boundaries.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass broader security implications for networked file systems. Attackers who gain access to legitimate SMB sessions could leverage this flaw to modify file attributes, permissions, or other metadata in ways that would normally be restricted by the original handle's credential scope. This effectively bypasses the intended access controls and could lead to unauthorized data modification, information disclosure, or complete system compromise depending on the target files and their associated permissions. The vulnerability particularly affects environments heavily reliant on SMB file sharing where proper credential isolation is crucial for maintaining security boundaries.
The fix implemented addresses this by ensuring that all SET_INFO operations execute with the same credential scope used when the handle was originally opened. This change consolidates the credential handling approach and eliminates the separate security information credential setup that previously existed. The solution employs direct override_creds() function calls to maintain compatibility with existing request credential overrides already utilized by other helpers such as rename and link operations, preventing credential nesting conflicts while ensuring consistent authorization behavior across all file information modification operations.
This vulnerability aligns with several cybersecurity frameworks and threat modeling approaches, particularly relating to CWE-284 (Improper Access Control) and CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). The fix demonstrates adherence to principle of least privilege by ensuring that file operations maintain the original credential context throughout their execution lifecycle. From an ATT&CK perspective, this vulnerability maps to T1078 (Valid Accounts) and T1548.001 (Abuse Elevation Control Mechanism), as it allows for privilege escalation through legitimate SMB session access. The remediation approach also reflects best practices in kernel security development by maintaining consistent credential handling patterns and eliminating potential attack surfaces through unified authorization contexts.
The implementation of this fix ensures that all SET_INFO operations maintain proper credential boundaries throughout their execution, preventing unauthorized privilege escalation while preserving legitimate file management functionality. This approach aligns with the broader security principle of least privilege enforcement and demonstrates effective mitigation of credential-based security flaws in kernel-level filesystem implementations. The solution's compatibility with existing credential override mechanisms prevents regression issues while providing comprehensive protection against the identified vulnerability across all SMB2 SET_INFO classes.