CVE-2026-64392

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64392", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.785Z", "datePublished": "2026-07-25T08:50:38.634Z", "dateUpdated": "2026-10-30T12:27:52.436Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:27:52.436Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for delete-on-close\n\nDelete-on-close can be completed by deferred or durable handle teardown,\nwhere no request work is available. Both the base-file unlink and the ADS\nxattr removal consequently run with the ksmbd worker credentials and can\nbypass filesystem permission checks.\n\nRun both operations with the credentials captured in struct file when the\nhandle was opened. This preserves the authenticated user's fsuid, fsgid,\nsupplementary groups and capability restrictions at final close."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - A remote SMB client reaches the vulnerable CREATE, SET_INFO, and CLOSE paths through ksmbd over TCP/445.\nAC:L - The attacker can deterministically request delete-on-close and close or disconnect the handle; no race or condition outside attacker control is required.\nPR:N - Although a valid SMB session and writable tree are required, ksmbd supports anonymous guest sessions, making exploitation possible without prior privileges on a reasonably configured writable guest share.\nUI:N - Exploitation requires only attacker-generated SMB requests and no action by another user.\nS:U - The unauthorized filesystem operations occur within the same host and kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:N - The flaw only unlinks filesystem objects or removes ADS xattrs; it provides no read primitive, information disclosure, or memory corruption.\nI:H - The privileged worker can delete attacker-selected files, empty directories, or ADS data despite the opener's filesystem restrictions, permitting complete destruction or replacement of protected exported data.\nA:H - The attacker can repeatedly and recursively delete exported resources, potentially causing complete loss of critical share data or services that depend on it."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/vfs.c", "fs/smb/server/vfs_cache.c"], "versions": [{"version": "f44158485826c076335d6860d35872271a83791d", "lessThan": "3cb2e6e2a6798909507b9d695e4b80e685e72d26", "status": "affected", "versionType": "git"}, {"version": "f44158485826c076335d6860d35872271a83791d", "lessThan": "f08b3f451f12eee4abd8a5981803bc36db84458b", "status": "affected", "versionType": "git"}, {"version": "f44158485826c076335d6860d35872271a83791d", "lessThan": "18c59109bb6fb816d5102171666f87cf1e29901d", "status": "affected", "versionType": "git"}, {"version": "f44158485826c076335d6860d35872271a83791d", "lessThan": "e72c15085b6d86f45d224d98aa75b5cace4aaab9", "status": "affected", "versionType": "git"}, {"version": "f44158485826c076335d6860d35872271a83791d", "lessThan": "4b7059974549d278e30fe70e2a4e421f9839817d", "status": "affected", "versionType": "git"}, {"version": "f44158485826c076335d6860d35872271a83791d", "lessThan": "52e2f21911158ec961cd5aae19c56460db382af0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/vfs.c", "fs/smb/server/vfs_cache.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3cb2e6e2a6798909507b9d695e4b80e685e72d26"}, {"url": "https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b"}, {"url": "https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d"}, {"url": "https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9"}, {"url": "https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d"}, {"url": "https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0"}], "title": "ksmbd: use opener credentials for delete-on-close", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/vfs.c", "fs/smb/server/vfs_cache.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3cb2e6e2a6798909507b9d695e4b80e685e72d26", "status": "affected", "version": "f44158485826c076335d6860d35872271a83791d", "versionType": "git"}, {"lessThan": "f08b3f451f12eee4abd8a5981803bc36db84458b", "status": "affected", "version": "f44158485826c076335d6860d35872271a83791d", "versionType": "git"}, {"lessThan": "18c59109bb6fb816d5102171666f87cf1e29901d", "status": "affected", "version": "f44158485826c076335d6860d35872271a83791d", "versionType": "git"}, {"lessThan": "e72c15085b6d86f45d224d98aa75b5cace4aaab9", "status": "affected", "version": "f44158485826c076335d6860d35872271a83791d", "versionType": "git"}, {"lessThan": "4b7059974549d278e30fe70e2a4e421f9839817d", "status": "affected", "version": "f44158485826c076335d6860d35872271a83791d", "versionType": "git"}, {"lessThan": "52e2f21911158ec961cd5aae19c56460db382af0", "status": "affected", "version": "f44158485826c076335d6860d35872271a83791d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/vfs.c", "fs/smb/server/vfs_cache.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F27EDAAB-8124-4492-9129-5B21C14498D2", "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for delete-on-close\n\nDelete-on-close can be completed by deferred or durable handle teardown,\nwhere no request work is available. Both the base-file unlink and the ADS\nxattr removal consequently run with the ksmbd worker credentials and can\nbypass filesystem permission checks.\n\nRun both operations with the credentials captured in struct file when the\nhandle was opened. This preserves the authenticated user's fsuid, fsgid,\nsupplementary groups and capability restrictions at final close."}], "id": "CVE-2026-64392", "lastModified": "2026-10-30T13:19:36.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-25T10:17:22.557", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3cb2e6e2a6798909507b9d695e4b80e685e72d26"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: use opener credentials for delete-on-close", "id": "2507082", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507082"}, "csaw": false, "cwe": "CWE-270", "details": ["A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an attacker to bypass filesystem permission checks during 'delete-on-close' operations. Specifically, when a file handle is torn down, the base-file unlink and extended attribute (xattr) removal operations incorrectly execute with ksmbd worker credentials instead of the original opener's credentials. This can lead to unauthorized deletion of files or removal of extended attributes, potentially compromising data integrity and availability."], "name": "CVE-2026-64392", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64392\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64392\nhttps://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64392-d5b4@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f08b3f451f12eee4abd8a5981803bc36db84458b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,18c59109bb6fb816d5102171666f87cf1e29901d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e72c15085b6d86f45d224d98aa75b5cace4aaab9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4b7059974549d278e30fe70e2a4e421f9839817d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,52e2f21911158ec961cd5aae19c56460db382af0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.145)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.96)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.39)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.1.4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T16:15:18.041720+00:00", "updated": "2026-09-04T23:00:17.073748+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}