Skip to main content

Linux Kernel ksmbd EUVDEUVD-2026-48936

| CVE-2026-64392 CRITICAL
2026-07-25 Linux GHSA-cq4q-mqm3-8r2p
Authentication Bypass Linux
9.1
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to ksmbd share
  2. Delivery
    Open file/ADS with delete-on-close via durable handle
  3. Exploit
    Release handle to force deferred teardown
  4. Execution
    Worker unlinks under privileged creds
  5. Impact
    Unauthorized file/ADS deletion

Vulnerability Assessment

Exploitation Conditions

Requires an authenticated SMB session to a host running the ksmbd kernel server with at least one exported, writable share (SMB/TCP 445 reachable). The bypass is triggered specifically when a delete-on-close operation is finalized through the deferred or durable-handle teardown path - i.e. after the requesting work context is gone - so the client must use durable or deferred handles and release them for the worker to complete the delete. Meaningful impact additionally requires that the targeted base file or ADS be one the opening user is not permitted to delete but the ksmbd worker credentials can. Limiting factors: authentication is required (not remote-unauthenticated), the vulnerable teardown path and a permission differential must both be present, and only hosts that actually enable ksmbd exports are affected - default kernels without ksmbd configured are not exposed.
Impact

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H, 9.1) overstates real-world risk. Exploitation requires an established, authenticated SMB session against a system that has enabled and exported shares via ksmbd, so PR:N is inaccurate - an authenticated user (PR:L) is required. The impact also depends on the delete completing through the deferred/durable teardown path and on the target file being one the worker credentials can remove but the user cannot, so AC:H is more realistic. Impact is integrity/availability via unauthorized deletion (C:N is correct; confidentiality is not affected). Corroborating signals point the same way: EPSS is 0.22% (13th percentile), there is no KEV listing and no public PoC. This is a legitimate authorization-bypass defect worth patching on ksmbd-exporting hosts, but it is not an urgent mass-exploitation priority; treat it as a moderate-priority fix rather than a 9.1 emergency.
Exploit ScenarioDerived

An authenticated SMB user opens a file (or ADS) via ksmbd with delete-on-close set on a share containing files owned by others that the user lacks delete permission for. The user relinquishes the handle so the final close is finalized by the durable/deferred teardown worker, which performs the unlink and ADS xattr removal under the privileged worker credentials, deleting the protected file despite the user's own permissions forbidding it. No public exploit code is identified at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Filesystem permission bypass in the Linux kernel's in-kernel SMB server (ksmbd) allows an authenticated SMB client to delete base files and Alternate Data Stream (ADS) xattrs it should not be permitted to remove. When a delete-on-close is finalized during deferred or durable handle teardown - a code path with no associated request work - the unlink and ADS removal executed with the ksmbd worker's credentials rather than the opening user's, skipping the fsuid/fsgid/supplementary-group/capability checks. No public exploit is identified at time of analysis; EPSS is low (0.22%, 13th percentile) and it is not in CISA KEV.

RemediationAI

Vendor-released patch: upgrade to Linux 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1 (or your distribution's equivalent). Ubuntu users should apply the kernel updates in USN-8726-1 and USN-8727-1 and reboot. Where patching must be deferred, the most effective compensating control is to stop using ksmbd for shares that grant differential per-user permissions - either disable/unload the ksmbd module and serve via user-space Samba instead (trade-off: service migration effort and potential performance change), or restrict ksmbd shares to trusted authenticated users only and avoid mixed-permission directory trees where a low-privilege user could delete another user's files (trade-off: does not fully eliminate the bypass, only reduces exploitable surface). Network-restricting SMB (TCP 445) to trusted management networks limits which principals can authenticate at all.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e72c15085b6d86f45d224d98aa75b5cace4aaab9
Linux patch: 6.12.96
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f08b3f451f12eee4abd8a5981803bc36db84458b
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4b7059974549d278e30fe70e2a4e421f9839817d
Linux 0 <6.12.96
Linux patch: 7.1.4
Linux 0 <7.1.4
Linux patch: 6.18.39
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <52e2f21911158ec961cd5aae19c56460db382af0
Linux 0 <6.18.39
Linux patch: 6.6.145
Linux patch: 7.2-rc1
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <18c59109bb6fb816d5102171666f87cf1e29901d
Linux 0 <6.6.145

Affected Packages

euvd linux fix: 6.6.145, 6.12.96, 6.18.39, 7.1.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ksmbd is the kernel-space SMB3 file server (fs/smb/server) introduced to complement/replace user-space Samba for performance. SMB delete-on-close semantics defer the actual unlink until the last handle is released; ksmbd additionally supports deferred and durable handles that survive request context, so the final close can be driven by a background worker thread instead of the request that would normally carry the authenticated user's credential struct. The root cause is an improper preservation of permission context (authorization class, CWE-281/CWE-863-style): both the base-file unlink and the ADS xattr removal ran under the worker's ambient credentials, so VFS permission checks were evaluated against the wrong identity. The fix reuses the credentials captured in the opener's struct file at open time (via override_creds semantics), restoring the authenticated user's fsuid, fsgid, supplementary groups and capability restrictions at final close. CPE data identifies the affected component only generically as cpe:2.3:a:linux:linux:*, i.e. the mainline kernel tree containing the ksmbd module.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vuln.today AI 5.9 MEDIUM

Requires an authenticated SMB session (PR:L) and a durable/deferred teardown plus permission differential (AC:H); impact is unauthorized deletion (I:H, A:L, C:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 27, 2026 - 05:22 NVD
9.1 (CRITICAL)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 cve.org
CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use opener credentials for delete-on-close

Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks.

Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user's fsuid, fsgid, supplementary groups and capability restrictions at final close.

Executive ViewAI

Why It Matters

The Linux kernel's in-kernel SMB server (ksmbd) contains a permission bypass vulnerability (CVE-2026-64392, CVSS 9.1) that allows authenticated SMB clients to delete files and data streams they should not have access to. This impacts organizations operating Linux-based file servers using ksmbd, potentially exposing sensitive data to unauthorized deletion and violating file integrity controls, though exploitation requires prior authentication.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 87% exploitable
Prevalence
Low
ksmbd is a niche kernel SMB server, seldom enabled versus user-space Samba
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64392 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383191 REF https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d REF https://git.kernel.org/stable/c/3cb2e6e2a6798909507b9d695e4b80e685e72d26 REF https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d REF https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0 REF https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9 REF https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy