Linux Kernel ksmbd EUVD-2026-48936

ksmbd is the kernel-space SMB3 file server (fs/smb/server) introduced to complement/replace user-space Samba for performance. SMB delete-on-close semantics defer the actual unlink until the last handle is released; ksmbd additionally supports deferred and durable handles that survive request context, so the final close can be driven by a background worker thread instead of the request that would normally carry the authenticated user's credential struct. The root cause is an improper preservation of permission context (authorization class, CWE-281/CWE-863-style): both the base-file unlink and the ADS xattr removal ran under the worker's ambient credentials, so VFS permission checks were evaluated against the wrong identity. The fix reuses the credentials captured in the opener's struct file at open time (via override_creds semantics), restoring the authenticated user's fsuid, fsgid, supplementary groups and capability restrictions at final close. CPE data identifies the affected component only generically as cpe:2.3:a:linux:linux:*, i.e. the mainline kernel tree containing the ksmbd module.