CVE-2026-64400

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A path traversal bypass exists in the ksmbd component. The ksmbd vfs path lookup() function uses LOOKUP BENEATH to restrict path resolution to the share root. While vfs path parent lookup() normally detects attempts to escape the share boundary using parent-directory components ('..') and returns an -EXDEV error, a bug in ksmbd vfs kern path() under caseless mode fails to intercept this error. Instead, it triggers a caseless retry logic intended for missing files. This process reconstructs the path and bypasses the LOOKUP BENEATH restriction, allowing users with write permissions to create zero-length files or directories outside the exported share.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.