CVE-2026-64392 Linux CVE debrief

Who should care

Linux system administrators and users, security teams responsible for Linux systems, and developers working with the Linux kernel should review and apply patches, monitor systems, and verify user permissions. This vulnerability could allow unauthorized access or bypass of filesystem permission checks, making it critical for Linux system administrators and security teams to take action. Developers working with the Linux kernel should also review the patch,

Why it matters

This vulnerability in the Linux kernel could allow unauthorized access or bypass of filesystem permission checks. Linux system administrators and security teams should review and apply patches, monitor systems, and verify user permissions.

• Verify Linux kernel versions and apply patches to prevent potential unauthorized access.
• Monitor systems for suspicious activity related to ksmbd.
• Review user permissions and access controls on Linux systems.

Technical summary

The vulnerability was in the ksmbd implementation of delete-on-close operations. These operations were executed with worker credentials instead of the opener's credentials, potentially allowing bypass of filesystem permission checks. The fix changes the credentials used for these operations to the opener's, preserving the authenticated user's permissions. This ensures that delete-on-close operations are performed with the correct permissions, preventing potential security risks. The patch reference provides additional technical details on the fix.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from Linux kernel maintainers.
• Verify the integrity of affected systems and monitor for suspicious activity.
• Update Linux kernel to a version that includes the fix.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD details provide information on the vulnerability, its impact, and patches. However, specific details about exploitation are not provided. The vulnerability was resolved by changing the credentials used for delete-on-close operations to the opener's credentials. This fix preserves the authenticated user's fsuid, fsgid, supplementary groups, and capability restrictions at final close. The patch reference provides additional information on the fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.