CVE-2026-64400 Linux CVE debrief

Who should care

Linux administrators and users with write access to ksmbd shares should assess their exposure and apply patches or mitigations as necessary. This vulnerability allows write-capable users to bypass path traversal restrictions in the Linux kernel's ksmbd module, potentially leading to data integrity issues or unauthorized data creation. Linux administrators and users with write access to ksmbd shares should review and apply patches from Linux kernel

Why it matters

This vulnerability allows write-capable users to bypass path traversal restrictions in the Linux kernel's ksmbd module, potentially leading to data integrity issues or unauthorized data creation. Linux administrators and users with write access to ksmbd shares should assess their exposure and apply patches or mitigations as necessary.

• Write-capable users can create zero-length files or directories outside the exported share
• Potential for data integrity issues or unauthorized data creation

Technical summary

The ksmbd module in the Linux kernel has a vulnerability that allows for path traversal bypass. This is due to a bug in the __ksmbd_vfs_kern_path() function under caseless mode, which fails to intercept the -EXDEV error and erroneously falls through to the caseless retry logic. The function fails to handle the -EXDEV error properly, allowing write-capable users to create zero-length files or directories outside the exported share. This vulnerability can be resolved by ensuring that the execution only proceeds to the caseless lookup retry when the error is specifically -ENOENT.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from Linux kernel maintainers
• Restrict access to the ksmbd share to only necessary users
• Monitor for suspicious activity on the ksmbd share
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the __ksmbd_vfs_kern_path() function under caseless mode, where it fails to intercept the -EXDEV error and erroneously falls through to the caseless retry logic. This allows write-capable users to create zero-length files or directories outside the exported share. The issue is resolved by ensuring that the execution only proceeds to the caseless lookup retry when the error is specifically -ENOENT. Any other errors, such as -EXDEV from a path traversal attempt, must be returned immediately. Linux kernel

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.