Improper access control in Linux kernel - CVE-2026-64394
Published: July 27, 2026
Vulnerability identifier: #VU139581
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64394
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify file access control metadata to grant additional access.
The vulnerability exists due to improper access control in smb2_set_info_sec() when handling SMB2_SET_INFO requests with InfoType SMB2_O_INFO_SECURITY. A remote user can send a specially crafted SMB2_SET_INFO request over a handle opened with FILE_WRITE_ATTRIBUTES only to modify file access control metadata to grant additional access.
The issue affects the SECURITY arm of SMB2 SET_INFO, where no per-handle check for FILE_WRITE_DAC or FILE_WRITE_OWNER is performed before rewriting the file's owner or DACL.
Affected software
Linux kernel
How to mitigate CVE-2026-64394
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0848b1d8b403f530878195dcbe241a2fddb9d0e1
- https://git.kernel.org/stable/c/44df157a1183a7f746caa970c169255da5ac61f8
- https://git.kernel.org/stable/c/9ab2ffd3ed3d4ca1667c52de27026ddabc11e537
- https://git.kernel.org/stable/c/aae600cdaffc6d9ce97645f129799a103a97d06d
- https://git.kernel.org/stable/c/e6aa731f1b4b3e08caebf66a99f04b22bdab2e99
- https://git.kernel.org/stable/c/f56535db508ead8dec1c481ad93d7d8acd8f8f1e