CVE-2026-64379

What it actually does

This is an improper input validation flaw in the Linux kernel SMB/CIFS client. When the client uses the modefromsid feature, it parses file mode information supplied by an SMB server through an NFS mode SID. The vulnerable code path applies the server-provided sub_auth[2] value directly to the client file mode field without masking it to valid Unix permission and file mode bits, 07777. A malicious or compromised SMB server can therefore supply out-of-range mode bits that the client kernel may later use when interpreting SMB file metadata. The expected impact is incorrect client-side permission or mode handling and potential kernel/client instability leading to denial of service; confidentiality impact is not indicated by the published scoring.

Why it matters to the business

Systems that mount SMB shares from untrusted, compromised, or attacker-controlled servers may be exposed to client-side disruption. In practical terms, exploitation could cause affected Linux clients to mishandle file metadata or become unstable when accessing a crafted SMB share, interrupting workloads that depend on network file shares. The issue is not currently listed in CISA KEV, has no reported exploit maturity, and has a low EPSS score, so broad active exploitation is not indicated; however, the network-reachable nature and high availability impact make remediation important for Linux endpoints and servers that use SMB mounts, especially where users or automation can connect to external SMB services.

How an attack unfolds

An attacker first needs a Linux SMB/CIFS client to connect to an SMB server the attacker controls, or to a compromised legitimate SMB server. Because the attack requires the client to process server-supplied metadata, exploitation commonly depends on a user, administrator, service, or automation mounting or browsing the crafted share with modefromsid enabled. The malicious server returns a security descriptor containing an NFS mode SID whose sub_auth[2] field includes bits outside the valid 07777 file mode mask. The vulnerable Linux kernel SMB client parses the DACL in parse_dacl() and copies that value into the client file mode without applying the proper mask. Subsequent client-side handling of the malformed mode can result in incorrect permission semantics or kernel/client instability, potentially causing denial of service for workloads using the mounted share.

How to fix it

Apply the Linux kernel update from the relevant distribution or kernel vendor that includes the fix to mask server-provided mode values to 07777 in the SMB client modefromsid path. No exact fixed package versions were provided in the input, so use the vendor advisory for the affected distribution or kernel branch to identify the corrected kernel build. Where immediate patching is not possible, mitigate by disabling or avoiding the modefromsid mount option, restricting SMB/CIFS mounts to trusted servers only, blocking outbound SMB traffic to untrusted networks, and preventing users or automation from mounting arbitrary SMB shares. Consider segmenting SMB access and enforcing allowlists for approved file servers.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package includes the vendor fix for the SMB client modefromsid masking issue. Check the active kernel version with standard OS tooling and compare it against the distribution advisory or changelog for the patch text 'smb: client: mask server-provided mode to 07777 in modefromsid'. Review mounted SMB/CIFS filesystems for the modefromsid option using /proc/mounts, findmnt, or mount output, and verify that only trusted SMB servers are used. For deeper validation, inspect the patched source or vendor backport to confirm that the value assigned from the NFS mode SID is masked with 07777 in the modefromsid parsing path. If using a test environment, mount a controlled SMB share that returns out-of-range mode bits and confirm the client masks the resulting mode rather than preserving invalid bits or becoming unstable.

Typical attack path

1. Identify Linux systems or users that mount SMB/CIFS shares and may use the modefromsid option.
2. Host or compromise an SMB server reachable by the target client.
3. Entice or cause the target system, user, or automated job to mount or access the malicious SMB share with modefromsid active.
4. Return a crafted security descriptor/DACL containing an NFS mode SID with an out-of-range sub_auth[2] mode value.
5. Trigger the Linux SMB client to parse the crafted metadata through the vulnerable modefromsid path.
6. Cause incorrect file mode handling or client-side instability, potentially disrupting access to files or the affected host.

How to detect it

There are no universally reliable indicators that prove exploitation from the vulnerability description alone. Detection should focus on exposure, suspicious SMB access patterns, and client-side instability. Review mount configuration and runtime mount data for CIFS/SMB shares using the modefromsid option. Examine system logs, kernel logs, and crash dumps for CIFS/SMB client warnings, kernel oops, panics, or hangs occurring shortly after connecting to an SMB share. Correlate those events with network logs showing outbound SMB connections, especially TCP/445 connections to unfamiliar, external, newly introduced, or user-controlled SMB servers. Review authentication and file server logs for unusual clients mounting shares immediately before Linux client instability. If endpoint telemetry is available, search for mount.cifs invocations, systemd mount units, fstab entries, or automation scripts that reference unapproved SMB servers or include modefromsid. In suspected cases, preserve kernel logs, crash dumps, mount command history, /etc/fstab, systemd .mount units, shell history for mount.cifs usage, and network flow records involving SMB destinations.

What your security team should do

• Prioritize kernel updates on Linux systems that mount SMB/CIFS shares, especially systems connecting to file servers outside tightly controlled internal infrastructure.
• Inventory SMB/CIFS mounts and identify any use of the modefromsid option.
• Restrict SMB client connections to approved file servers and block outbound TCP/445 to untrusted networks where operationally feasible.
• Temporarily remove or avoid the modefromsid option on affected systems until patched if SMB access must continue.
• Monitor for kernel warnings, CIFS client errors, or crashes associated with SMB share access.
• Educate administrators and users not to mount SMB shares from untrusted sources.
• Track vendor advisories for exact fixed kernel versions and ensure reboot into the patched kernel after update.
• Because this issue is not currently KEV-listed and has low EPSS, handle as a high-impact availability risk rather than evidence of active widespread exploitation.