Improper access control in Linux kernel - CVE-2026-64391

Vulnerability identifier: #VU139578

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64391

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass permission checks for alternate data stream I/O.

The vulnerability exists due to improper access control in ksmbd alternate data stream handling when processing read and write operations on alternate data streams. A remote user can access a file over SMB and perform alternate data stream read or write operations to bypass permission checks for alternate data stream I/O.

Alternate data streams are stored as extended attributes, and the vulnerable paths recheck inode permissions and LSM policy using the current task credentials instead of the credentials captured when the SMB handle was opened.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-azure (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-31.31~24.04.1, 7.0.0-1006.7, 7.0.0-1011.11~24.04.1, 7.0.0-1012.12, 7.0.0-1012.12~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1011.11, 7.0.0-1014.14
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1

• https://git.kernel.org/stable/c/2b4592cea214683de0f2ce6f8c22c097fb0ea1ab
• https://git.kernel.org/stable/c/52a56cf53ec834c44ac1b4d16d585f26613ee5ce
• https://git.kernel.org/stable/c/a8f5d39971bbad9340d49cd41b0e2da9452a649d
• https://git.kernel.org/stable/c/baa5e094886fffa7e6272edcb5e08be5ce28262c

• Improper access control in Linux kernel smb server
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-oracle-7.0
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-7.0