External risk intelligence

Linux Kernel SMB Vulnerability Allows Unauthorized Information Modification

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-64393

This vulnerability affects ksmbd, a kernel-based SMB server. While SMB is a network-accessible protocol, it is designed for internal file sharing and is typically restricted to local area networks or VPNs. Direct exposure of SMB services to the public internet is considered a misconfiguration and is not a common or intended deployment pattern.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Linux kernel's SMB server component that could allow improper handling of file information requests. The issue has been resolved, but understanding its nature is important for maintaining secure systems. The main concern is confirming relevance and exposure within your specific environment.

Improper file handling in Linux kernel.
Matters for secure internal file sharing.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a flaw in the Linux kernel's SMB server (ksmbd) that mishandles file information requests. This flaw allows an attacker to potentially bypass access controls by using incorrect credentials during specific file operations. If successful, this could lead to unauthorized modifications or denial of service on the affected system.

Requires network access to the SMB service.
Triggered by specific SMB2 SET_INFO requests.
Risk of unauthorized data modification or denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's ksmbd could allow an attacker to bypass access controls. When handling specific SMB2 commands, the system might incorrectly use the credentials of the ksmbd worker instead of the original opener's credentials, potentially leading to unauthorized modifications or access to file information.

File metadata and permissions at risk.
Incorrect credential checks may occur.
Unauthorized file system changes possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's ksmbd component impacts systems using the SMB protocol for file sharing. Infrastructure or platform teams are likely responsible for the underlying kernel, while security teams should assess external exposure. The first practical step is to identify all systems running ksmbd, confirm their network accessibility, and determine their business criticality to prioritize remediation efforts.

Infrastructure/Platform teams own the issue.
Verify ksmbd exposure and criticality.
Plan and coordinate kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ksmbd in the Linux kernel?

ksmbd is an implementation of the SMB protocol that runs directly within the Linux kernel. It allows a Linux system to act as a file server, enabling Windows, macOS, or other Linux clients to access and share files over a network. Because it operates at the kernel level, it is designed to provide high-performance file sharing services for enterprise environments.

How does CVE-2026-64393 affect file operations?

This vulnerability is an access control flaw. It occurs because the system mistakenly performs file information updates using the generic credentials of a background worker instead of the specific user credentials provided when the file was first opened. This mismatch can allow unauthorized changes to file attributes or metadata.

Do I need to send a complex payload to trigger this bug?

No. The vulnerability is triggered by legitimate SMB2 SET_INFO requests. These are standard commands used by clients to modify file properties. The bug is not about malicious code injection, but rather a logic error where the kernel fails to switch to the correct user context while processing these specific file modification commands.

Is my system at risk if it only handles internal traffic?

According to Halo Surface Signal, this vulnerability is classified as 'Unlikely' for most systems because ksmbd is typically restricted to local networks or VPNs. While the vulnerability requires network access, it is generally not exposed to the public internet. You should focus on internal segments where SMB services are reachable by a broad range of users.

When should I prioritize patching this kernel issue?

Prioritize patching if your infrastructure uses ksmbd to share sensitive file systems across your internal network. Since this involves the core Linux kernel, work with your platform team to identify active instances. Once identified, plan to move to a patched kernel version to ensure that file operation credentials are consistently and correctly enforced.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.