Linux Kernel ksmbd CVE-2026-64139

Upgrade to a patched Linux stable kernel release: 6.6.142 or later (6.6 branch), 6.12.92 or later (6.12 branch), 7.0.11 or later (7.0 branch), or 6.18.34 or later (6.18 branch). Upstream fix commits are published at git.kernel.org - representative patches include eced48cb08f07393a5ea770fdd1026452883c3ad, 9d378e17c864da08c3a4df41dae92cfa6468b00a, af92ee994cc7f7e83a41c2025f32257a2f82a7ef, and related stable backports. Ubuntu administrators should apply USN-8593-1. If an immediate kernel update is operationally infeasible, the most effective compensating control is to unload ksmbd entirely (modprobe -r ksmbd or adding it to /etc/modprobe.d/blacklist.conf) - this eliminates the attack surface completely but terminates all ksmbd-served SMB shares. Alternatively, blocking inbound TCP port 445 at the host firewall (iptables -A INPUT -p tcp --dport 445 -j DROP) limits exposure to network-adjacent attackers, though local attackers with shell access can still trigger the leak if ksmbd remains loaded. Restricting which users may set extended POSIX ACLs on ksmbd-shared filesystems (via ACL mount options or filesystem policies) reduces the triggering surface but does not eliminate the vulnerability if pre-existing files already carry sufficient ACL entries.