Executive brief
A vulnerability was identified in the Linux kernel's ksmbd component, which provides SMB file sharing services. The issue involves how the system handles file information updates, potentially allowing actions to be performed with incorrect security credentials. This could lead to unauthorized file modifications or security bypasses on systems using ksmbd for network storage.
Technical details
A vulnerability in the ksmbd SMB server within the Linux kernel stemmed from SMB2 SET_INFO handlers calling path-based VFS helpers using the current ksmbd worker credentials rather than the credentials captured when the file handle was initially opened. This mismatch could allow SET_INFO operations to bypass certain owner, inode permission, and Linux Security Module (LSM) checks. The fix implements a credential override using override_creds() to ensure the entire SET_INFO dispatch runs under the scope of the credentials associated with the file opener. This vulnerability affects multiple stable kernel branches and has been patched in versions 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4.
Affected products
- Linux Linux Kernel 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-06-13: other: Vulnerability fixed in upstream commits
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0ce682867fd506f61f40c76bde7e4205bde34e87
- https://git.kernel.org/stable/c/20ee516a62989a8d505ee432f9e59525ea23984e
- https://git.kernel.org/stable/c/5cbabf3a71575cd31bc7785d92d4ab42338a654b
- https://git.kernel.org/stable/c/8cc9ec711f5255167247a9ab6a7179b787426ed7
- https://git.kernel.org/stable/c/b35afd5cf8fab236ef21117e42ee45691d4ffa7b
- https://git.kernel.org/stable/c/b383bcad3d2fe634b26efbce53e22bbb5753a520