CVE-2026-64391
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In the Linux kernel, the ksmbd filesystem runs alternate data stream (ADS) I/O operations with the current task credentials instead of the credentials of the user who opened the SMB handle. This can bypass inode permission and LSM checks.
Risk Assessment
An attacker can read or write data in alternate data streams without proper permissions, leading to data leakage or integrity compromise.
Recommendation
Apply the Linux kernel patch that runs ADS I/O operations with the credentials captured when the SMB handle was opened.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the current task credentials. Run ADS I/O with the credentials captured when the SMB handle was opened.