Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-64393, describes an improper credential handling issue within the ksmbd module of the Linux kernel. Specifically, when processing SMB2 SET_INFO requests, the system was using the 'current ksmbd worker credentials' for VFS helper calls instead of the 'credentials captured when the handle was opened'. This allowed for a privilege escalation or bypass of security checks during SET_INFO operations.
Due to limitations in accessing the git.kernel.org commit details directly with the provided tools (both get_commit_infos and fetch_url_content failed to retrieve the content), a direct analysis of the patch diffs was not possible. Therefore, the identification of vulnerable functions relies on a careful interpretation of the vulnerability description and the proposed fix.
The description clearly points to 'SMB2 SET_INFO handlers' and the 'complete SET_INFO dispatch' as the areas of concern. The fix involves ensuring this dispatch runs with the correct 'opener credentials' using override_creds().
Based on common kernel module naming conventions and the functional description, the most likely candidate for the central dispatch function handling SMB2 SET_INFO requests is ksmbd_smb2_set_info. This function would be the entry point where the credential context for subsequent VFS operations is either correctly established or, in the vulnerable state, incorrectly propagated.
The file path fs/smb/server/smb2pdu.c is a highly probable location for such a function, as smb2pdu.c typically handles SMB2 Protocol Data Unit processing, which includes SET_INFO requests. While other files like ksmbd_vfs.c might contain the VFS helpers, the vulnerability's root cause lies in the caller (the SET_INFO handler) failing to provide the correct credential context.
The confidence is set to 'medium' because the exact function name and file path cannot be confirmed by direct patch inspection. However, the logical deduction based on the detailed vulnerability description provides a strong indication of the function's role and location.
ksmbd_smb2_set_infofs/smb/server/smb2pdu.c