Executive brief
A security issue was identified in the Linux kernel's ksmbd component, which provides file-sharing services over a network. Under certain conditions, when a file is marked to be deleted upon closing, the system would use administrative-level credentials instead of the specific user's permissions to perform the deletion. This could allow a user to bypass security restrictions and delete files or metadata they should not have access to modify.
Technical details
A vulnerability in the Linux kernel's ksmbd (SMB server) occurs during 'delete-on-close' operations. When a file handle teardown is deferred or durable, the request context may be unavailable, causing the base-file unlink and ADS xattr removal to execute with ksmbd worker credentials rather than the authenticated user's credentials. This allows the operations to bypass standard filesystem permission checks (fsuid, fsgid, and capability restrictions). The fix ensures that the credentials captured in 'struct file' at the time of the initial open are used to override the current credentials during the final close and deletion process. The issue is reachable over the network via SMB if ksmbd is active.
Affected products
- Linux Linux Kernel 6.6.145, 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-06-13: other: Vulnerability fixed in kernel source
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d
- https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d
- https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0
- https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9
- https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b