CVE-2026-64138

What it actually does

This flaw is an improper input validation issue in the Linux kernel ksmbd SMB server. During ACL inheritance, ksmbd retrieves an NT Security Descriptor from a parent directory and uses the embedded Owner SID and Group SID without sufficiently validating that those SID structures are well formed and safely bounded. A low-privileged authenticated SMB user may be able to place or trigger processing of a malformed security descriptor so that kernel-mode ksmbd code parses invalid SID data. Because ksmbd runs in the kernel, successful exploitation can affect confidentiality, integrity, and availability of the host, including kernel memory corruption, information disclosure, denial of service, or potentially broader compromise depending on kernel configuration and exploitability.

Why it matters to the business

Systems exposing Linux kernel ksmbd shares to authenticated users may be at risk of service disruption or host compromise from a network-accessible flaw requiring only low privileges. A successful attack could interrupt file-sharing services, corrupt or expose shared data, or compromise the underlying server that hosts business files. Although this vulnerability is not currently listed in CISA KEV, has no reported mature public exploit, and has a low EPSS score, the high CVSS impact means internet-facing or broadly accessible SMB services should still be prioritized for patching.

How an attack unfolds

An attacker first obtains valid SMB access to a Linux host running ksmbd. They identify a writable share or directory where security descriptors or ACL-related metadata can be created, modified, or inherited. The attacker then causes a parent directory to contain a malformed NT Security Descriptor, specifically with invalid Owner SID or Group SID data. When a child object is created or ACL inheritance is otherwise triggered, ksmbd parses the parent descriptor in kernel context. Without proper SID validation, ksmbd may read or operate on invalid SID structures, leading to kernel memory corruption, a crash, information disclosure, or potentially arbitrary code execution if the attacker can shape memory conditions. Post-exploitation activity would likely focus on maintaining access to the host, accessing shared files, or pivoting from the compromised file server.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the ksmbd fix introducing validation for Owner SID and Group SID values in parent NT Security Descriptors. If no fixed kernel package is available yet, mitigate by disabling ksmbd, replacing kernel ksmbd exposure with a patched user-space SMB implementation where appropriate, or limiting SMB access to trusted networks and authenticated users only. Remove internet exposure for TCP/445 wherever possible. Review share permissions to minimize write access and prevent low-privileged users from changing security descriptors unnecessarily. Because no affected product or exact fixed version was provided, rely on vendor advisories and kernel package changelogs for confirmation that the CVE or the ksmbd SID validation patch is included.

How to confirm the fix worked

Confirm the host is no longer running a vulnerable kernel by checking the installed kernel package version against the distribution or appliance vendor advisory for this issue. Verify that the patch containing ksmbd SID validation is present in the running kernel, not merely installed on disk. Confirm whether ksmbd is enabled by checking loaded modules, ksmbd services, and listeners on TCP/445. Validate that SMB access is restricted to intended networks and that low-privileged users cannot modify ACL/security-descriptor metadata on parent directories unless required. Where feasible, use a non-production test system to confirm malformed or invalid NT Security Descriptor SID data is rejected without a kernel crash or abnormal ksmbd behavior.

Typical attack path

1. Discover a Linux SMB service backed by ksmbd rather than user-space Samba.
2. Authenticate with a low-privileged SMB account that has access to at least one writable share or directory.
3. Create or modify directory security metadata so the parent NT Security Descriptor contains a malformed Owner SID or Group SID.
4. Trigger ACL inheritance by creating a child file or directory or by causing ksmbd to evaluate inherited ACLs.
5. Exploit the unsafe SID parsing path in kernel context to crash the system, disclose memory, corrupt kernel memory, or attempt privilege escalation.
6. Use any resulting host-level access to access shared data, tamper with files, deploy persistence, or move laterally.

How to detect it

To determine whether exploitation may already have occurred, review kernel logs, crash dumps, SMB service logs, authentication logs, and filesystem metadata around ksmbd shares. Focus on systems running ksmbd with writable SMB shares. Look for kernel oops, panic, KASAN, slab corruption, general protection fault, or NULL pointer dereference messages involving ksmbd worker threads near SMB file or directory creation, ACL modification, or security-descriptor operations. Review SMB logs for low-privileged accounts repeatedly creating directories, changing permissions, setting security descriptors, or causing failed SMB2 SET_INFO security operations before a crash. Check auditd or filesystem telemetry for unusual extended-attribute or ACL changes on parent directories in SMB shares. If crash dumps are available, inspect stack traces for ksmbd ACL inheritance, NT security descriptor parsing, SID parsing, or SMB security-info handling functions. There are no public threat actors or ransomware campaigns reported for this CVE in the supplied data, so detection should focus on behavioral evidence rather than actor-specific indicators.

• ksmbd
• ksmbd.mountd
• BUG: kernel NULL pointer dereference
• general protection fault
• KASAN: slab-out-of-bounds
• KASAN: use-after-free
• kernel panic
• Oops:
• RIP: ksmbd
• Call Trace: ksmbd
• smb2_set_info
• SMB2 SET_INFO
• security descriptor
• NT Security Descriptor
• Owner SID
• Group SID
• ACL inheritance

What your security team should do

• Inventory Linux systems and appliances exposing SMB over ksmbd, especially those reachable from untrusted networks or large user populations.
• Patch affected kernels using vendor-supplied updates and reboot systems so the fixed kernel is active.
• If patching cannot be completed quickly, disable ksmbd or restrict TCP/445 to trusted management and user networks with host and network firewalls.
• Review SMB share permissions and remove unnecessary write, ACL modification, or administrative rights from low-privileged accounts.
• Monitor kernel logs and SMB authentication/activity logs for crashes, malformed ACL activity, repeated file or directory creation attempts, and abnormal ksmbd failures.
• Treat any unexplained kernel crash in ksmbd on an exposed file server as potentially security-relevant and preserve logs, memory dumps, and filesystem metadata for investigation.
• Track vendor advisories for exact fixed kernel versions because affected product and fixed-version data were not provided in the input.