CVE-2026-64393
A critical flaw in the Linux kernel's ksmbd SMB server allowed attackers with network access to modify file attributes and cause denial of service by exploiting incorrect credential handling in SMB2 SET_INFO operations. The flaw has been fixed by ensuring SET_INFO runs with the credentials of the file opener. No public exploit or known active exploitation is documented.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems using the ksmbd SMB server.
Real-world impact
An attacker could alter file metadata or disrupt service on vulnerable Linux SMB servers.
Why this severity
CVSS v3.1 score 9.1 (Critical) due to network‑adjacent attack, low‑complexity exploit that impacts integrity and availability while requiring no privileges or user interaction.
What to do about it
- 011. Determine the currently running Linux kernel version.
- 022. Obtain and apply the kernel patch that resolves the ksmbd SET_INFO credential issue (provided via your distribution's security updates).
- 033. Reboot the system to load the patched kernel.
NVD-referenced vendor advisory (the NVD description states the vulnerability has been resolved in the Linux kernel).
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.