Bug 2507062 (CVE-2026-64388) - CVE-2026-64388 kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions
Summary: CVE-2026-64388 kernel: smb/client: fix chown/chgrp with SMB3 POSIX Extensions
Keywords:
Status: NEW
Alias: CVE-2026-64388
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-25 10:03 UTC by OSIDB Bzimport
Modified: 2026-07-29 22:26 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-25 10:03:01 UTC 
In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix chown/chgrp with SMB3 POSIX Extensions

Ownership (chown) and group (chgrp) modifications were being ignored when
mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or
CIFS_MOUNT_MODE_FROM_SID were also explicitly set.

Fix this by checking for posix_extensions in cifs_setattr_nounix() when
updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map
and set the ownership/group information on the server.
Comment 1 Mauro Matteo Cascella 2026-07-29 22:25:04 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072527-CVE-2026-64388-82d9@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.