CVE-2026-64391

What it actually does

This is an authorization-bypass flaw in the Linux kernel ksmbd SMB server implementation. ksmbd stores SMB alternate data streams as extended attributes, and the read/write path for those streams used the credentials of the task performing the extended-attribute operation rather than the credentials captured when the SMB file handle was opened. As a result, SMB alternate data stream access could be evaluated under the wrong security context, potentially allowing a remote attacker to read, modify, or create stream data despite file permissions or Linux Security Module policy that should have blocked the operation.

Why it matters to the business

A vulnerable Linux file server using in-kernel SMB service may allow unauthorized access to data stored in SMB alternate data streams. In practical terms, this can lead to exposure of sensitive files, tampering with file-associated metadata or hidden stream content, and disruption of file-server operations. The CVSS score is critical, but the current EPSS value is low, it is not currently listed in CISA KEV, and no public exploit maturity is reported; however, SMB services are commonly exposed internally and are high-value targets, so affected ksmbd deployments should still be prioritized for patching.

How an attack unfolds

An attacker first identifies a Linux SMB service implemented by ksmbd, typically reachable over TCP/445. They then connect to an exposed SMB share using any allowed access path, which may include guest, anonymous, or low-privileged credentials depending on server configuration. The attacker opens a file handle under one authorization context and then performs read or write operations against an SMB alternate data stream associated with that file. Because ksmbd routes alternate data stream operations through extended-attribute helpers that recheck permissions using the current task credentials rather than the opener credentials, the access decision may be made under an unintended security context. If exploitable in the deployed configuration, the attacker can read protected stream data, write unauthorized stream content, or manipulate data associated with files without having the intended permissions.

How to fix it

Apply the Linux kernel update from the relevant distribution or vendor that includes the ksmbd fix described as using opener credentials for alternate data stream I/O. No exact fixed package versions were provided in the input, so administrators should consult their OS vendor security advisory and kernel changelog for this CVE or for the patch titled `ksmbd: use opener credentials for ADS I/O`. If immediate patching is not possible, disable ksmbd, unload or blacklist the `ksmbd` kernel module, stop the ksmbd service, or migrate SMB serving to a patched alternative such as a supported Samba release. Restrict SMB exposure to trusted networks only, block unnecessary inbound TCP/445 at network boundaries, disable guest or anonymous SMB access, enforce least-privilege share permissions, and monitor or restrict alternate data stream usage where operationally feasible.

How to confirm the fix worked

Confirm that the running kernel package includes the vendor fix, not just that an updated package is installed; a reboot may be required for kernel fixes to take effect. Validate by checking the active kernel version with `uname -a`, reviewing distribution package metadata and changelogs for this CVE or the ksmbd ADS credential fix, and confirming whether `ksmbd` is loaded with tools such as `lsmod` or `modinfo ksmbd`. If ksmbd is not required, verify that the module is not loaded and the service is not listening on TCP/445. Functional validation can be performed in a controlled test by creating two users with different file permissions, opening a file over SMB as a lower-privileged user, and confirming that alternate data stream reads/writes are denied wherever normal file permissions or LSM policy should deny them.

Typical attack path

1. Scan for systems exposing SMB over TCP/445.
2. Identify Linux SMB servers using ksmbd rather than user-space Samba where possible.
3. Authenticate with available low-privileged, guest, or anonymous SMB access if permitted by the server.
4. Open a target file or path on an accessible SMB share.
5. Attempt alternate data stream operations using SMB stream syntax such as a file name followed by a stream name.
6. Abuse the credential mismatch in ksmbd ADS I/O to bypass the intended file, xattr, or LSM permission checks.
7. Read, alter, or create alternate stream data and use the access for data theft, staging, persistence, or tampering.

How to detect it

To assess possible prior exploitation, review SMB server logs, kernel logs, auditd records, EDR telemetry, and file-integrity monitoring for alternate data stream activity on ksmbd-hosted shares. Focus on SMB requests or filenames containing stream syntax, unexpected extended-attribute reads or writes, and activity where low-privileged, guest, or anonymous SMB sessions access files with stream names. On Linux hosts, collect evidence of ksmbd use, including loaded modules, service activity, and listening TCP/445 sockets. If auditd or eBPF telemetry is available, look for `getxattr`, `setxattr`, `listxattr`, or `removexattr` operations against files served by ksmbd, especially where xattr names resemble DOS stream storage. Also review authentication logs for unusual SMB logons followed by rapid file enumeration or stream access attempts. There are no public, vulnerability-specific exploit artifacts in the provided input, so detections should be behavior-based rather than signature-only.

• ksmbd
• ksmbd.mountd
• tcp/445
• TCP/445
• :$DATA
• user.DosStream.
• getxattr
• setxattr
• listxattr
• removexattr
• modinfo ksmbd
• lsmod | grep ksmbd
• /sys/module/ksmbd
• /proc/fs/ksmbd

What your security team should do

• Inventory Linux systems exposing SMB and determine which use in-kernel ksmbd.
• Prioritize patching any internet-facing or broadly reachable ksmbd servers, even though the vulnerability is not currently in CISA KEV and has low reported EPSS.
• Apply vendor kernel updates that include the ksmbd opener-credential ADS I/O fix and reboot into the patched kernel.
• Disable ksmbd on systems where SMB serving is unnecessary or replace it with a supported, patched SMB service.
• Restrict inbound TCP/445 to trusted administrative and client networks only.
• Disable guest and anonymous SMB access and review share permissions for least privilege.
• Search historical SMB, audit, and file-integrity logs for unusual alternate data stream activity, especially from low-privileged accounts.
• Add detection for alternate data stream access patterns and extended-attribute operations associated with ksmbd until patch coverage is confirmed.