CVE-2026-64392

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where delete-on-close operations can be completed during deferred or durable handle teardown without available request work. In these scenarios, the base-file unlink and the Alternate Data Stream (ADS) xattr removal are executed using ksmbd worker credentials instead of the user's credentials. This allows the operations to bypass filesystem permission checks. The fix involves using the credentials captured in struct file during the handle opening process to preserve the authenticated user's fsuid, fsgid, supplementary groups, and capability restrictions during the final close.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.