SB20260727170 - Path traversal in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2026-64400)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to create files or directories outside the exported share.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in __ksmbd_vfs_kern_path() when processing crafted paths with parent-directory components during caseless lookup retry. A remote user can send a specially crafted path to create files or directories outside the exported share.

The issue occurs because an -EXDEV error from path traversal detection is not handled before the caseless retry logic runs, and exploitation is limited to zero-length files or directories.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95
• https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67