Critical severity · published Jul 25, 2026
CVE-2026-64393
ksmbd: run set info with opener credentials
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: run set info with opener credentials
SMB2 SET_INFO handlers call path-based VFS helpers after checking the
access mask granted to the SMB handle. Those helpers perform their owner,
inode permission and LSM checks using the current ksmbd worker credentials.
Run the complete SET_INFO dispatch with the credentials captured when the
handle was opened. This also removes the separate security information
credential setup and keeps all SET_INFO classes under one credential scope.
Direct override_creds() is used because it can nest with the request
credential overrides already used by rename and link helpers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
5.15 before 6.1.178; 6.2 before 6.6.145; 6.7 before 6.12.96; 6.13 before 6.18.39; 6.19 before 7.1.4 · source: NVD
LI
Linux · Linux
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 5cbabf3a71575cd31bc7785d92d4ab42338a654b; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before b35afd5cf8fab236ef21117e42ee45691d4ffa7b; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 0ce682867fd506f61f40c76bde7e4205bde34e87; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 20ee516a62989a8d505ee432f9e59525ea23984e; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 8cc9ec711f5255167247a9ab6a7179b787426ed7; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before b383bcad3d2fe634b26efbce53e22bbb5753a520; +1 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64393
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-64393
Patch
https://git.kernel.org/stable/c/0ce682867fd506f61f40c76bde7e4205bde34e87
Patch
https://git.kernel.org/stable/c/20ee516a62989a8d505ee432f9e59525ea23984e
Patch
https://git.kernel.org/stable/c/5cbabf3a71575cd31bc7785d92d4ab42338a654b
Patch
https://git.kernel.org/stable/c/8cc9ec711f5255167247a9ab6a7179b787426ed7
Patch
https://git.kernel.org/stable/c/b35afd5cf8fab236ef21117e42ee45691d4ffa7b
Patch
https://git.kernel.org/stable/c/b383bcad3d2fe634b26efbce53e22bbb5753a520
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability
