{"id":"CVE-2026-64388","aliases":[],"cve":{"records":[{"id":"CVE-2026-64388","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-19T15:36:31.784Z","published":"2026-07-25T08:50:36.202Z","modified":"2026-10-30T12:27:49.236Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:27:49.236Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-19T20:38:26.851Z"}],"references":[{"url":"https://git.kernel.org/stable/c/c0fe1118a1471d459f76c3e70ff2abbf784ce6bf","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/6825a45f6b8ef76b0ee32649ec3d6e39ca143a18","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/27ead8c5418af6bfab711079fecb9414d78d4cae","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/3eaec47518e126e6dcd1a48521d740278073f0ec","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/550cfb8a81181331d4d0f76ab75ee58a0bf41e3e","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/760ef2c579c2609cf17fb1cd5392f64d42d43d33","tags":[],"source":"Linux"}],"weaknesses":[{"id":"CWE-682","description":"CWE-682 Incorrect Calculation","source":"CISA-ADP"}],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.18","versionEndExcluding":"7.2"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-16T15:40:07.284651Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"smb/client: fix chown/chgrp with SMB3 POSIX Extensions","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix chown/chgrp with SMB3 POSIX Extensions\n\nOwnership (chown) and group (chgrp) modifications were being ignored when\nmounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or\nCIFS_MOUNT_MODE_FROM_SID were also explicitly set.\n\nFix this by checking for posix_extensions in cifs_setattr_nounix() when\nupdating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map\nand set the ownership/group information on the server.","score":7.8,"severity":"high","published":"2026-07-25T08:50:36.202Z","modified":"2026-10-30T12:27:49.236Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"b326614ea2159ea5c835d320f261d05d080cd201","status":"affected","lessThan":"c0fe1118a1471d459f76c3e70ff2abbf784ce6bf","versionType":"git"},{"version":"b326614ea2159ea5c835d320f261d05d080cd201","status":"affected","lessThan":"6825a45f6b8ef76b0ee32649ec3d6e39ca143a18","versionType":"git"},{"version":"b326614ea2159ea5c835d320f261d05d080cd201","status":"affected","lessThan":"27ead8c5418af6bfab711079fecb9414d78d4cae","versionType":"git"},{"version":"b326614ea2159ea5c835d320f261d05d080cd201","status":"affected","lessThan":"3eaec47518e126e6dcd1a48521d740278073f0ec","versionType":"git"},{"version":"b326614ea2159ea5c835d320f261d05d080cd201","status":"affected","lessThan":"550cfb8a81181331d4d0f76ab75ee58a0bf41e3e","versionType":"git"},{"version":"b326614ea2159ea5c835d320f261d05d080cd201","status":"affected","lessThan":"760ef2c579c2609cf17fb1cd5392f64d42d43d33","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-64388"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"4.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.18","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-64388"}],"remediation":[],"references":["https://git.kernel.org/stable/c/c0fe1118a1471d459f76c3e70ff2abbf784ce6bf","https://git.kernel.org/stable/c/6825a45f6b8ef76b0ee32649ec3d6e39ca143a18","https://git.kernel.org/stable/c/27ead8c5418af6bfab711079fecb9414d78d4cae","https://git.kernel.org/stable/c/3eaec47518e126e6dcd1a48521d740278073f0ec","https://git.kernel.org/stable/c/550cfb8a81181331d4d0f76ab75ee58a0bf41e3e","https://git.kernel.org/stable/c/760ef2c579c2609cf17fb1cd5392f64d42d43d33"],"sources":[{"name":"CVE","id":"CVE-2026-64388","modified":"2026-10-30T12:27:49.236Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-64388"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-10-30T12:52:34.058Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T17:45:31.659Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}