CVE-2026-64379: smb: client: mask server-provided mode to 07777 in modefromsid
In the Linux kernel, the following vulnerability has been resolved:
smb: client: mask server-provided mode to 07777 in modefromsid
When modefromsid is active, parsedacl() applies the server-provided subauth[2] value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking, same as in the read path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel SMB clients are affected when modefromsid is active. The issue concerns parsing server-provided NFS mode SID data during SMB ACL handling.
What access does an attacker need to exploit it?
The severity vector indicates local attack access and low privileges, with no user interaction required. Exploitation also depends on the client accepting a server-provided mode value through the affected modefromsid path.
What is the impact of a successful exploit?
The provided severity data rates confidentiality and availability impact as high, while integrity impact is listed as none. The underlying flaw allows an unmasked server-provided sub_auth[2] mode value to be applied to cf_mode.
What does the fix change?
The fix masks the server-provided mode value to 07777 in modefromsid, matching the masking already used in the read path.