vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-64138

ksmbd: validate SID in parent security descriptor during ACL inheritance

HIGH
8.8
CVSS Score
Published: July 19, 2026 at 03:40 PM UTC
Updated: October 21, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.4%

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smb_validate_ntsd_sid() helper to safely validate Owner SID and Group SID inside the NT Security Descriptor (smb_ntsd) retrieved from the parent directory.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
5.15 ≤ v < 6.12.926.13 ≤ v < 6.18.346.19 ≤ v < 7.0.117.17.1 rc17.1 rc27.1 rc37.1 rc4e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9
Vendor states this is fixed in 18d8db24b0a5b7be4829238dd4022236df02d421 (fixed)
Vendor states this is fixed in 1c9d0646a9959752f11ca1080dc1ff26bd1756cb (fixed)
Vendor states this is fixed in 69f030cf95488ae1186c72ac8c66fd279664ea7f (fixed)
Vendor states this is fixed in f0e5c9c663badc9982e6941322eef1cb17de0f11 (fixed)
Vendor states this is fixed in 5.15 (unaffected)
Vendor states this is fixed in 6.12.92 (unaffected)
Vendor states this is fixed in 6.18.34 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.0.11 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

References (5)

Patch
Source: cverecord
https://git.kernel.org/stable/c/f0e5c9c663badc9982e6941322eef1cb17de0f11
Patch
Source: cverecord
https://git.kernel.org/stable/c/18d8db24b0a5b7be4829238dd4022236df02d421
Patch
Source: cverecord
https://git.kernel.org/stable/c/1c9d0646a9959752f11ca1080dc1ff26bd1756cb
Patch
Source: cverecord
https://git.kernel.org/stable/c/69f030cf95488ae1186c72ac8c66fd279664ea7f
Source: cverecord
https://git.kernel.org/stable/c/8efbea0253b7fa2d1960cab0fed36544ca0b41ab

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card