CVE-2026-64393

kernel: ksmbd: run set info with opener credentials

Loading…

Severity

Important

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · July 25, 2026

Updated · October 20, 2026

Description

A flaw was found in the Linux kernel's ksmbd component. This vulnerability allows a local attacker to escalate privileges by manipulating Server Message Block (SMB2) SET_INFO operations. The system incorrectly uses the ksmbd worker's credentials instead of the original user's credentials when performing file system checks, potentially bypassing security restrictions and enabling unauthorized actions.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-270 · Privilege Context Switching Error