Improper access control in Linux kernel - CVE-2026-64392
Published: July 27, 2026
Vulnerability identifier: #VU139579
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64392
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass filesystem permission checks and delete files or remove ADS xattrs.
The vulnerability exists due to improper access control in ksmbd delete-on-close handling when tearing down deferred or durable handles without request work. A remote user can open a file and trigger delete-on-close processing to bypass filesystem permission checks and delete files or remove ADS xattrs.
The issue occurs because final close operations run with ksmbd worker credentials instead of the credentials captured when the file was opened.
Affected software
Linux kernel
How to mitigate CVE-2026-64392
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d
- https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d
- https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0
- https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9
- https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b