What is the CVSS score of EUVD-2026-48932?

EUVD-2026-48932 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by EUVD-2026-48932?

The Linux kernel SMB/CIFS client silently fails to apply file ownership changes (chown/chgrp) on SMB3 shares configured with POSIX Extensions, creating a gap between administrative intent and actual…. A patch is available.

How to fix or mitigate EUVD-2026-48932?

Within 24 hours, inventory all Linux systems with mounted SMB3 shares and document their kernel versions and current CIFS mount configurations. Within 7 days, apply the vendor-released patch for CVE-2026-64388 to all affected systems, testing on a non-production SMB3 mount first to confirm that chown/chgrp operations now complete successfully. Within 30 days, conduct a compliance audit of file ownership changes made on SMB3 shares during the vulnerability window to identify and remediate any skipped operations, and review all production SMB3 mount configurations to ensure CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID flags are set to prevent future silent failures.

Linux Kernel EUVD-2026-48932

| CVE-2026-64388 HIGH

2026-07-25 Linux

GHSA-p59x-f8qp-h8m2

Linux

High

Disputed · 7.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

3.3 LOW

Local access to mounted share required; no confidentiality or availability impact; integrity is limited to ownership metadata silently not applied.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 09:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Jul 27, 2026 - 05:43 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:50 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:50 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix chown/chgrp with SMB3 POSIX Extensions

Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set.

Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server.

AnalysisAI

Silent ownership update failure in the Linux kernel's SMB/CIFS client allows local users mounting SMB3 shares with POSIX Extensions to have chown/chgrp operations silently dropped by the kernel unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID flags are also explicitly set. The root cause is a missing posix_extensions check in cifs_setattr_nounix() that prevented id_mode_to_cifs_acl() from being invoked to relay ownership changes to the server. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) reflects low exploitation likelihood for what is primarily a logic/correctness defect.

Technical ContextAI

The vulnerability resides in the Linux kernel SMB/CIFS client (fs/smb/client), specifically in cifs_setattr_nounix() which handles POSIX attribute changes for mounted SMB shares. SMB3 POSIX Extensions is an optional negotiation feature enabling UNIX-style ownership semantics over SMB3; when active, UID/GID changes should invoke id_mode_to_cifs_acl() to propagate them to the server. The code incorrectly conditioned this path on CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID mount flags being set, omitting the posix_extensions path entirely. The CWE is listed as N/A by the reporter, but the class is best characterized as CWE-284 (Improper Access Control) or a logic error - not CWE-125/200 as the 'Information Disclosure' tag implies. Affected CPE: cpe:2.3:a:linux:linux.

RemediationAI

Vendor-released patch: Linux 7.1.4 and 7.2-rc1. Apply the upstream fix via kernel update; the patch adds a posix_extensions check in cifs_setattr_nounix() so that id_mode_to_cifs_acl() is invoked for UID/GID changes even without CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID. Ubuntu users should apply updates per USN-8726-1 (https://ubuntu.com/security/notices/USN-8726-1) and USN-8727-1 (https://ubuntu.com/security/notices/USN-8727-1). As a workaround prior to patching, explicitly adding the cifsacl mount option or mode_from_sid mount option when mounting SMB3 shares with POSIX Extensions will trigger the correct code path. The workaround has no negative side effects but requires remounting affected shares.

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-48932 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-48932

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code