CVE-2026-64388

high

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp…

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server.

CVSS

7.8

7.8 (CVSS v3.1)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

Timeline (UTC)

Published: 2026-07-25 10:17

Modified: 2026-10-30 13:19

NVD status: Modified

Last synced 1 day ago

Verified against the source API 2026-10-30 13:38 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥4.18 <7.1.4

Weakness classification (CWE)

NVD-CWE-noinfo CWE-682

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/550cfb8a81181331d4d0f76ab75ee58a0bf41e3e

Patch / mitigation: https://git.kernel.org/stable/c/760ef2c579c2609cf17fb1cd5392f64d42d43d33

References

https://git.kernel.org/stable/c/27ead8c5418af6bfab711079fecb9414d78d4cae 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3eaec47518e126e6dcd1a48521d740278073f0ec 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/550cfb8a81181331d4d0f76ab75ee58a0bf41e3e 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6825a45f6b8ef76b0ee32649ec3d6e39ca143a18 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/760ef2c579c2609cf17fb1cd5392f64d42d43d33 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c0fe1118a1471d459f76c3e70ff2abbf784ce6bf 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Data sources

NVD CVE API 2.0 — fetched 2026-10-30 13:38 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-64388

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs