{"id":"CVE-2026-64400","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent path traversal bypass by restricting caseless retry\n\nksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path\nresolution within the share root","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent path traversal bypass by restricting caseless retry\n\nksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path\nresolution within the share root. W…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.15.145, < 5.16","linux_kernel >= 6.1.71, < 6.2","linux_kernel >= 6.3.10, < 7.1.4"],"patched":["linux_kernel 7.1.4"],"published":"2026-07-25","updated":"2026-09-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64400","references":[{"url":"https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00357,"epssPercentile":0.29364,"ingestedAt":"2026-09-05T13:39:57.859Z","slug":"CVE-2026-64400","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent path traversal bypass by restricting caseless retry\n\nksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path\nresolution within the share root. When a crafted path attempts to\nescape the share boundary using parent-directory components ('..'),\nvfs_path_parent_lookup() detects this and immediately fails,\nreturning -EXDEV.\n\nHowever, a bug exists in __ksmbd_vfs_kern_path() under caseless mode.\nThe function fails to intercept the -EXDEV error and erroneously\nfalls through to the caseless retry logic, which is intended only\nfor genuinely missing files. During this retry process, the path\nis reconstructed, leading to an unintended LOOKUP_BENEATH bypass\nthat allows write-capable users to create zero-length files or\ndirectories outside the exported share.\n\nFix this by ensuring that the execution only proceeds to the caseless\nlookup retry when the error is specifically -ENOENT. Any other errors,\nsuch as -EXDEV from a path traversal attempt, must be returned immediately.\n\n## Affected\n\n- `linux_kernel >= 5.15.145, < 5.16`\n- `linux_kernel >= 6.1.71, < 6.2`\n- `linux_kernel >= 6.3.10, < 7.1.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.1.4`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}