CVE-2026-64391

If you're running ksmbd with Alternate Data Streams (ADS) enabled, you're exposed to a credential bypass where ADS file operations silently use the current task's security context instead of the opener's credentials. The bug is straightforward in mechanism: ADS in ksmbd is implemented by storing streams as extended attributes, and the xattr code path re-checks the current task's credentials rather than preserving the opener's credentials from the SMB handle. When a user opens a file and an ADS operation runs in that context, the kernel correctly re-validates credentials — but that's wrong for SMB, where the handle should carry the opener's security context forward. A low-privileged user can trigger operations that execute with elevated credentials if the SMB session has them, or cross user boundaries in multiuser share configurations. Check your ksmbd deployments now. If ADS is in use — and many Windows-oriented shares enable it for metadata or zone identifiers — audit what streams exist and whether any cross-user access patterns are possible. The patch uses opener credentials for ADS I/O, which is the correct fix at the SMB layer. However, understand what it doesn't do: the underlying VFS/xattr path still re-checks current task credentials for every other consumer. This is a surgical fix on top of a deeper architectural mismatch. The deeper issue is that ADS-as-xattrs was an implementation convenience that silently discarded a security boundary fundamental to SMB semantics. This is the third credential-context boundary failure in five years when Windows SMB semantics map onto Unix filesystem abstractions (the CIFS multiuser bug and nfsd EXECAT variants are the others). The pattern tells you that every new SMB feature touching VFS primitives carries this same invisible risk until there's a cross-layer mechanism enforcing credential invariant boundaries. Treat ksmbd's ADS as security-sensitive functionality that needs explicit credential-boundary auditing for any expansion — stream types, delegation, lease semantics — not as settled infrastructure.

Reviewed through automated stages and approved by a human before publication.