Linux ksmbd CVE-2026-64138

Vendor-released patch: upgrade to a fixed Linux stable kernel - 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later within each series), per the git.kernel.org stable commits f0e5c9c663badc9982e6941322eef1cb17de0f11, 18d8db24b0a5b7be4829238dd4022236df02d421, 1c9d0646a9959752f11ca1080dc1ff26bd1756cb, and 69f030cf95488ae1186c72ac8c66fd279664ea7f. If patching cannot be scheduled immediately, the most effective compensating control is to disable the ksmbd server (unload/blacklist the ksmbd kernel module and stop exporting SMB shares via ksmbd), falling back to userspace Samba where SMB service is required - the trade-off is loss of the in-kernel server's performance. Where ksmbd must remain enabled, restrict share access to trusted authenticated principals and remove write permissions from untrusted users, since exploitation requires an authenticated user who can influence a parent directory's security descriptor; also restrict network reachability of SMB (TCP 445) to trusted segments via firewall, accepting reduced client accessibility. Reference the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-64138.