SB20260727181 - Improper access control in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-64391)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass permission checks for alternate data stream I/O.

The vulnerability exists due to improper access control in ksmbd alternate data stream handling when processing read and write operations on alternate data streams. A remote user can access a file over SMB and perform alternate data stream read or write operations to bypass permission checks for alternate data stream I/O.

Alternate data streams are stored as extended attributes, and the vulnerable paths recheck inode permissions and LSM policy using the current task credentials instead of the credentials captured when the SMB handle was opened.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2b4592cea214683de0f2ce6f8c22c097fb0ea1ab
• https://git.kernel.org/stable/c/52a56cf53ec834c44ac1b4d16d585f26613ee5ce
• https://git.kernel.org/stable/c/a8f5d39971bbad9340d49cd41b0e2da9452a649d
• https://git.kernel.org/stable/c/baa5e094886fffa7e6272edcb5e08be5ce28262c