{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-64400", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.785Z", "datePublished": "2026-07-25T08:50:43.655Z", "dateUpdated": "2026-08-17T04:54:57.921Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:54:57.921Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent path traversal bypass by restricting caseless retry\n\nksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path\nresolution within the share root. When a crafted path attempts to\nescape the share boundary using parent-directory components ('..'),\nvfs_path_parent_lookup() detects this and immediately fails,\nreturning -EXDEV.\n\nHowever, a bug exists in __ksmbd_vfs_kern_path() under caseless mode.\nThe function fails to intercept the -EXDEV error and erroneously\nfalls through to the caseless retry logic, which is intended only\nfor genuinely missing files. During this retry process, the path\nis reconstructed, leading to an unintended LOOKUP_BENEATH bypass\nthat allows write-capable users to create zero-length files or\ndirectories outside the exported share.\n\nFix this by ensuring that the execution only proceeds to the caseless\nlookup retry when the error is specifically -ENOENT. Any other errors,\nsuch as -EXDEV from a path traversal attempt, must be returned immediately." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "baseScore": 8.6, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable lookup is reached remotely through SMB2 CREATE requests handled by ksmbd over TCP/445.\nAC:L - The attacker controls the crafted parent-directory path and can issue repeated or concurrent requests; any required lookup/create race is attacker-driven.\nPR:N - Although a valid SMB session and writable tree connection are required, ksmbd supports anonymous guest sessions on writable shares, requiring no prior privileges in a reasonable deployment.\nUI:N - Exploitation requires only attacker-generated SMB requests and no action by a victim.\nS:U - The bypass affects filesystems managed by the same host kernel and does not cross a virtualization or comparable security authority boundary.\nC:L - File contents are not exposed, but the out-of-share caseless directory walk and distinguishable errors can disclose limited pathname-existence metadata.\nI:L - The attacker can create chosen zero-length files or directories outside the export, but cannot supply file contents or overwrite arbitrary existing data through this flaw.\nA:H - Repeated creation in an escaped world-writable location can exhaust root-filesystem inodes, storage, or tmpfs memory and cause system-wide service unavailability." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/vfs.c" ], "versions": [ { "version": "74d7970febf7e9005375aeda0df821d2edffc9f7", "lessThan": "8c9a4f1327eb71efbf14842e7b8a6d965077eb67", "status": "affected", "versionType": "git" }, { "version": "74d7970febf7e9005375aeda0df821d2edffc9f7", "lessThan": "54bab9ba5a9f156ffa9324fcbe5a356fd0242f95", "status": "affected", "versionType": "git" }, { "version": "019aae488dbc67c97a33db03652e20e2c9e3afa7", "status": "affected", "versionType": "git" }, { "version": "6927ffe7479c72e7ebf885507227266a75f7c97d", "status": "affected", "versionType": "git" }, { "version": "ef6cc1c465786b3e4e735d1ab8b616b3e94402df", "status": "affected", "versionType": "git" }, { "version": "5.15.145", "lessThan": "5.16", "status": "affected", "versionType": "semver" }, { "version": "6.1.71", "lessThan": "6.2", "status": "affected", "versionType": "semver" }, { "version": "6.3.10", "lessThan": "6.4", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/vfs.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.71" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67" }, { "url": "https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95" } ], "title": "ksmbd: prevent path traversal bypass by restricting caseless retry", "x_generator": { "engine": "bippy-1.2.0" } } } }