CVE-2026-64400 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: prevent path traversal bypass by restricting caseless retry
ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using parent-directory components ('..'), vfs_path_parent_lookup() detects this and immediately fails, returning -EXDEV.
However, a bug exists in __ksmbd_vfs_kern_path() under caseless mode. The function fails to intercept the -EXDEV error and erroneously falls through to the caseless retry logic, which is intended only for genuinely missing files. During this retry process, the path is reconstructed, leading to an unintended LOOKUP_BENEATH bypass that allows write-capable users to create zero-length files or directories outside the exported share.
Fix this by ensuring that the execution only proceeds to the caseless lookup retry when the error is specifically -ENOENT. Any other errors, such as -EXDEV from a path traversal attempt, must be returned immediately.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in the Linux kernel ksmbd subsystem represents a critical path traversal bypass that undermines the security boundaries of SMB file sharing exports. This flaw exists within the ksmbd_vfs_path_lookup() function which properly enforces LOOKUP_BENEATH restrictions to contain path resolution within the share root directory. When malicious clients attempt to escape the share boundary using parent-directory components such as '..' sequences, the vfs_path_parent_lookup() function correctly identifies these attempts and immediately fails with the -EXDEV error code, which should terminate the operation and prevent unauthorized access beyond the configured share boundaries.
The core technical flaw lies in the __ksmbd_vfs_kern_path() function's handling of error codes during caseless mode operations. When operating in caseless mode, the system attempts to resolve paths by first checking for exact matches before falling back to case-insensitive lookups for files that may not exist with their original case. However, the function fails to properly intercept and handle the -EXDEV error code that indicates a path traversal attempt has been detected and rejected. Instead of immediately returning this error to prevent further processing, the buggy implementation allows execution to continue into the caseless retry logic intended only for genuinely missing files that have no exact match.
This design flaw creates a dangerous race condition where legitimate path traversal detection fails and the system proceeds to reconstruct the path through the caseless lookup mechanism. The path reconstruction process effectively bypasses the LOOKUP_BENEATH restriction that was previously established, allowing unauthorized users with write capabilities to create zero-length files or directories outside of the originally exported share root. This represents a direct violation of the principle of least privilege and could enable attackers to write files to arbitrary locations on the filesystem, potentially leading to privilege escalation or data exfiltration.
The operational impact of this vulnerability extends beyond simple file creation, as it fundamentally compromises the security model of ksmbd-based SMB shares. Attackers can exploit this weakness to escape share boundaries and potentially access other directories that should remain restricted, undermining the entire purpose of share-level access controls. The fix implemented ensures that caseless lookup retry logic only executes when encountering -ENOENT errors, which indicate truly missing files that require case-insensitive resolution. Any other error conditions including -EXDEV from path traversal attempts must be returned immediately without proceeding to caseless retry mechanisms.
This vulnerability aligns with CWE-22 Path Traversal and CWE-73 Relative Path Traversal categories, while also demonstrating characteristics of privilege escalation through improper access control. From an ATT&CK perspective, this represents a technique for gaining unauthorized access to resources outside of intended boundaries, potentially enabling lateral movement within the network and persistent access through file system manipulation. The fix directly addresses the root cause by implementing proper error handling that prevents the caseless retry logic from being invoked with invalid error codes, thereby maintaining the integrity of share boundary restrictions established by the LOOKUP_BENEATH flag.