CVE-2026-64394

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY

commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a

permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to

fsctl_set_sparse and noted that "similar handle-level checks exist in other

functions but are missing here." The SMB2 SET_INFO SECURITY arm is one of

the missing ones, and the most security-relevant: smb2_set_info_sec() calls

set_info_sec() with no per-handle access check.

set_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it

rewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via

set_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and

rewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr().

Every other persistent-mutation arm of the sibling handler

smb2_set_info_file() checks fp->daccess first (FILE_WRITE_DATA /

FILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATT

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References