CVE-2026-64391
A critical flaw in the Linux kernel’s SMB server (ksmbd) allowed attackers to read or write alternate data streams by bypassing permission checks. The issue was fixed by ensuring SMB operations use the credentials captured when the handle was opened. Users with older kernels that have not applied the update are vulnerable.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running versions of ksmbd that have not been updated to include the credential‑check fix. This affects any system that exposes SMB services via ksmbd.
Real-world impact
An attacker could read hidden data streams or inject malicious content into files served over SMB, potentially exfiltrating sensitive information or compromising system integrity.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited remotely without authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Update the Linux kernel to a version that includes the ksmbd credential‑check fix.
NVD description indicates the vulnerability has been resolved.
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.