CVE-2026-64391

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where Alternate Data Streams (ADS), which are stored as extended attributes (xattrs), do not use the credentials captured when the SMB handle was opened. Instead, the read and write paths call VFS xattr helpers that recheck inode permissions and Linux Security Module (LSM) policy using the current task credentials, potentially leading to incorrect permission enforcement.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.