CVE-2026-64400
kernel: ksmbd: prevent path traversal bypass by restricting caseless retry
Loading…
Severity
ImportantRed Hat Product Security
CVSS
Review impact separately from score.
Published · July 25, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's ksmbd component. A vulnerability in the ksmbd component allows a remote authenticated attacker to bypass path restrictions. Specifically, a bug in the caseless retry logic during path resolution fails to properly handle directory traversal attempts. This allows the attacker to create files or directories outside of the intended shared directory boundaries.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')