External risk intelligence

Linux Kernel ksmbd use-after-free vulnerability allows privilege bypass.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-64392

The vulnerability exists in ksmbd, a kernel-based SMB server. SMB services are commonly deployed to facilitate file sharing across networks and are frequently exposed as internet-facing or edge services in various enterprise and infrastructure deployments to allow remote file access.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a security vulnerability within the Linux kernel's SMB server component. The issue could allow unauthorized actions by bypassing file system permission checks, potentially affecting data integrity and availability at a high level. It is important to confirm if this technology is in use within our environment.

Bypasses file permissions on Linux SMB.
Affects data integrity and availability.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a vulnerability in the Linux kernel's SMB server (ksmbd) to bypass file permission checks. This occurs when a file handle is closed, and certain cleanup operations incorrectly use the server's credentials instead of the original user's. This allows an attacker to potentially delete files or attributes they would otherwise not have access to.

Requires network access to the SMB service.
Triggered by closing a file handle.
Risk: Unauthorized file deletion.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's ksmbd could allow an attacker to bypass filesystem permission checks when deleting files or Alternate Data Streams (ADS) via a delete-on-close operation. This could occur when the system is handling deferred or durable handle teardown, and the request lacks available work. The bypass happens because the deletion operations would incorrectly use the ksmbd worker credentials instead of the authenticated user's credentials.

Bypass filesystem permission checks.
Delete files or ADS with worker credentials.
Unauthorized deletion of sensitive files.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's ksmbd component is impacted by this vulnerability, suggesting that teams managing Linux servers and file-sharing services are primarily responsible. The first action should be to identify all Linux systems running ksmbd, determine their exposure and criticality, and then engage the appropriate system owners to plan remediation.

Linux infrastructure teams should own the issue.
Verify SMB service exposure and criticality.
Plan remediation based on risk and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ksmbd in the Linux kernel?

ksmbd is a kernel-based implementation of the SMB (Server Message Block) protocol. It allows Linux systems to act as file servers, enabling remote users and applications to share, access, and manage files over a network, similar to how Windows file sharing functions in enterprise environments.

How does CVE-2026-64392 create a security risk?

The vulnerability involves an improper handling of user credentials during file deletion. When a file is marked for deletion upon closing, the system incorrectly uses the elevated permissions of the ksmbd background worker rather than the credentials of the original user, allowing the process to bypass standard filesystem permission checks.

When does this vulnerability trigger?

The flaw is triggered during a 'delete-on-close' operation, specifically when handling deferred or durable file handle teardown. It does not trigger during standard, active file interactions; instead, it occurs during the cleanup phase when no specific request work is available to verify the user's identity.

Do I need to worry if my ksmbd service is internal?

Halo Surface Signal indicates that while this service is often found on internet-facing edge devices for remote access, internal-only deployments are not inherently immune. Because the vulnerability involves how the kernel processes file permissions, any accessible SMB share could be used to attempt unauthorized file deletion regardless of network placement.

Is there a practical way to start responding to this?

First, verify if your Linux infrastructure is running ksmbd. If it is, determine how these systems are exposed and identify which data they manage. Once you have an inventory, coordinate with your system administration teams to prioritize patching the affected kernel versions to ensure proper credential enforcement.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.