Executive brief
A vulnerability was identified in the Linux kernel's SMB server (ksmbd) involving how it handles Alternate Data Streams (ADS). The system was incorrectly using current task credentials instead of the original file opener's credentials when performing certain file operations. This could potentially allow unauthorized access or bypass security policies when reading or writing specific file metadata.
Technical details
In the Linux kernel ksmbd implementation, Alternate Data Streams (ADS) are stored as extended attributes (xattrs). The read and write paths for these streams were calling VFS xattr helpers which perform permission checks and Linux Security Module (LSM) policy validation using the current task credentials rather than the credentials captured when the SMB handle was initially opened. This discrepancy in credential application could allow operations to proceed under incorrect security contexts. The fix involves using override_creds() and revert_creds() to ensure ADS I/O runs with the credentials associated with the file pointer (fp->filp->f_cred). Patch sets have been released for multiple stable kernel branches including 6.12.y, 6.18.y, and 7.1.y.
Affected products
- Linux Linux Kernel 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-07-25: advisory: CVE-2026-64391 published by kernel.org and NVD.