Improper access control in Linux kernel - CVE-2026-64137
Published: July 20, 2026
Vulnerability identifier: #VU138501
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64137
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to affect service availability.
The vulnerability exists due to improper access control in the CIFS SWN netlink notify handler when sending witness notification commands. A local user can send crafted RESOURCE_CHANGE or CLIENT_MOVE notifications to affect service availability.
The intended sender is the cifs.witness helper, but any local process could send notifications to the in-kernel witness handler.
How to mitigate CVE-2026-64137
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95
- https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b
- https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d
- https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed
- https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3
- https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f
- https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91