Bug 2507270 (CVE-2026-64393)

Summary: CVE-2026-64393 kernel: ksmbd: run set info with opener credentials
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's ksmbd component. This vulnerability allows a local attacker to escalate privileges by manipulating Server Message Block (SMB2) SET_INFO operations. The system incorrectly uses the ksmbd worker's credentials instead of the original user's credentials when performing file system checks, potentially bypassing security restrictions and enabling unauthorized actions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-25 10:13:49 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: run set info with opener credentials

SMB2 SET_INFO handlers call path-based VFS helpers after checking the
access mask granted to the SMB handle. Those helpers perform their owner,
inode permission and LSM checks using the current ksmbd worker credentials.

Run the complete SET_INFO dispatch with the credentials captured when the
handle was opened. This also removes the separate security information
credential setup and keeps all SET_INFO classes under one credential scope.

Direct override_creds() is used because it can nest with the request
credential overrides already used by rename and link helpers.
Comment 1 TEJ RATHI 2026-07-27 06:26:45 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072528-CVE-2026-64393-200f@gregkh/T