CVE-2026-64394

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the Linux kernel, the ksmbd module contains a permission bypass. The smb2 set info sec() function calls set info sec() without performing a per-handle access check. This allows a client to open a handle with only FILE WRITE ATTRIBUTES permissions and use the SMB2 SET INFO operation with the SMB2 O INFO SECURITY InfoType to rewrite a file's owner and Discretionary Access Control List (DACL), effectively granting themselves unauthorized access. This occurs because the set info sec() function in fs/smb/server/smbacl.c re-permissions files via notify change(), set posix acl(), and ksmbd vfs set sd xattr() without verifying if the handle possesses WRITE DAC or WRITE OWNER permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.