What is the CVSS score of CVE-2026-64388?

CVE-2026-64388 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-64388?

Within 24 hours, inventory all Linux systems with mounted SMB3 shares and document their kernel versions and current CIFS mount configurations. Within 7 days, apply the vendor-released patch for CVE-2026-64388 to all affected systems, testing on a non-production SMB3 mount first to confirm that chown/chgrp operations now complete successfully. Within 30 days, conduct a compliance audit of file ownership changes made on SMB3 shares during the vulnerability window to identify and remediate any skipped operations, and review all production SMB3 mount configurations to ensure CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID flags are set to prevent future silent failures.

Linux Kernel CVE-2026-64388

Q: Which versions of Linux Kernel are affected by CVE-2026-64388?

The Linux kernel SMB/CIFS client silently fails to apply file ownership changes (chown/chgrp) on SMB3 shares configured with POSIX Extensions, creating a gap between administrative intent and actual…. A patch is available.

EUVD-2026-48932 HIGH

Incorrect Calculation (CWE-682)

2026-07-25 Linux

GHSA-p59x-f8qp-h8m2

Linux

High

Disputed · 7.8 Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Mount SMB3 share with posix extensions
Delivery

Omit cifsacl/mode_from_sid flags
Exploit

Issue chown or chgrp on share
Execution

Kernel skips id_mode_to_cifs_acl() call
Persist

Ownership change silently dropped server-side
Impact

Security policy based on file ownership bypassed

Vulnerability Assessment

Weakness	CWE CWE-682 ASVS 5.0 V15 - Secure Coding and Architecture Calculation correctness
Exploitation Conditions	Requires a locally-mounted SMB3 share with POSIX Extensions negotiated (i.e., mount option 'posix' or server-side POSIX Extensions enabled) AND the absence of the CIFS_MOUNT_CIFS_ACL (cifsacl) or CIFS_MOUNT_MODE_FROM_SID (mode_from_sid) mount flags. The user must have local access to the mounted filesystem and permission to invoke chown/chgrp. Exploitation is limited to Linux SMB/CIFS client environments where SMB3 POSIX Extensions is actively in use - a non-default, explicitly configured deployment mode. The impact is confined to ownership metadata integrity; no memory safety, code execution, or remote vector exists.
Impact	The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) is significantly overstated relative to the actual impact. The vulnerability is a silent no-op: chown/chgrp requests are dropped without error, rather than triggering memory corruption or data exposure. Confidentiality is not meaningfully affected (no data disclosed), availability is not affected (no crash or resource exhaustion), and integrity impact is limited to ownership metadata not being applied as intended - more accurately I:L/A:N/C:N. The EPSS of 0.20% at the 10th percentile reflects low community-assessed exploitability. No KEV listing, no POC. The realistic risk is that ownership-based access controls on SMB3+POSIX-extensions mounts silently fail, which is a correctness and policy-enforcement concern rather than a remote attack surface. Exploitation requires local access to a system with a deliberately configured SMB3 POSIX Extensions mount, narrowing the population significantly.
Exploit ScenarioDerived	A local user mounts an SMB3 share using the posix mount option (enabling POSIX Extensions) without cifsacl or mode_from_sid. The user issues chown or chgrp on files on the share expecting to transfer ownership; the kernel silently discards the operation, leaving the server-side ownership unchanged. An administrator relying on chown to revoke file ownership as a security boundary would observe no error while the ownership change never takes effect.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Silent ownership update failure in the Linux kernel's SMB/CIFS client allows local users mounting SMB3 shares with POSIX Extensions to have chown/chgrp operations silently dropped by the kernel unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID flags are also explicitly set. The root cause is a missing posix_extensions check in cifs_setattr_nounix() that prevented id_mode_to_cifs_acl() from being invoked to relay ownership changes to the server. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) reflects low exploitation likelihood for what is primarily a logic/correctness defect.

RemediationAI

Vendor-released patch: Linux 7.1.4 and 7.2-rc1. Apply the upstream fix via kernel update; the patch adds a posix_extensions check in cifs_setattr_nounix() so that id_mode_to_cifs_acl() is invoked for UID/GID changes even without CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID. Ubuntu users should apply updates per USN-8726-1 (https://ubuntu.com/security/notices/USN-8726-1) and USN-8727-1 (https://ubuntu.com/security/notices/USN-8727-1). As a workaround prior to patching, explicitly adding the cifsacl mount option or mode_from_sid mount option when mounting SMB3 shares with POSIX Extensions will trigger the correct code path. The workaround has no negative side effects but requires remounting affected shares.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <550cfb8a81181331d4d0f76ab75ee58a0bf41e3e

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <760ef2c579c2609cf17fb1cd5392f64d42d43d33

Linux patch: 7.1.4

Linux 0 <7.1.4

Linux patch: 7.2-rc1

Affected Packages

euvd linux fix: 7.1.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Linux kernel SMB/CIFS client (fs/smb/client), specifically in cifs_setattr_nounix() which handles POSIX attribute changes for mounted SMB shares. SMB3 POSIX Extensions is an optional negotiation feature enabling UNIX-style ownership semantics over SMB3; when active, UID/GID changes should invoke id_mode_to_cifs_acl() to propagate them to the server. The code incorrectly conditioned this path on CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID mount flags being set, omitting the posix_extensions path entirely. The CWE is listed as N/A by the reporter, but the class is best characterized as CWE-284 (Improper Access Control) or a logic error - not CWE-125/200 as the 'Information Disclosure' tag implies. Affected CPE: cpe:2.3:a:linux:linux.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 3.3 LOW

Local access to mounted share required; no confidentiality or availability impact; integrity is limited to ownership metadata silently not applied.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:50 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:50 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix chown/chgrp with SMB3 POSIX Extensions

Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set.

Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server.

Executive ViewAI

Why It Matters

The Linux kernel SMB/CIFS client silently fails to apply file ownership changes (chown/chgrp) on SMB3 shares configured with POSIX Extensions, creating a gap between administrative intent and actual permissions on shared storage. This affects organizations using Linux servers to access SMB-based storage systems, potentially violating compliance requirements for file access controls and leaving data vulnerable to unintended access. With EPSS score of 0.2%, active exploitation is unlikely, but the permission enforcement failure poses significant data governance and audit risk.

Business Impact: High

Compensating Controls

Apply vendor patch. Interim mitigation: configure all SMB3 share mounts with CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID mount flags to enable ownership change relay to the server, reducing the window before patching.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

High

Linux kernel cifs client used across enterprise Linux deployments

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Same weakness CWE-682 – Incorrect Calculation

View all

CVE-2021-44847 CRITICAL POC

9.8

CVE-2022-23066 CRITICAL POC

9.1

CVE-2022-28048 HIGH POC

8.8

CVE-2020-0022 HIGH POC

8.8

CVE-2019-16346 HIGH POC

8.8

CVE-2023-42460 HIGH POC

7.5

CVE-2022-22138 HIGH POC

7.5

CVE-2022-30780 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64388 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383205 REF https://git.kernel.org/stable/c/27ead8c5418af6bfab711079fecb9414d78d4cae REF https://git.kernel.org/stable/c/3eaec47518e126e6dcd1a48521d740278073f0ec REF https://git.kernel.org/stable/c/550cfb8a81181331d4d0f76ab75ee58a0bf41e3e REF https://git.kernel.org/stable/c/6825a45f6b8ef76b0ee32649ec3d6e39ca143a18 REF https://git.kernel.org/stable/c/760ef2c579c2609cf17fb1cd5392f64d42d43d33 REF https://git.kernel.org/stable/c/c0fe1118a1471d459f76c3e70ff2abbf784ce6bf

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back