CVE-2026-64392: ksmbd: use opener credentials for delete-on-close

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use opener credentials for delete-on-close

Delete-on-close can be completed by deferred or durable handle teardown,
where no request work is available. Both the base-file unlink and the ADS
xattr removal consequently run with the ksmbd worker credentials and can
bypass filesystem permission checks.

Run both operations with the credentials captured in struct file when the
handle was opened. This preserves the authenticated user's fsuid, fsgid,
supplementary groups and capability restrictions at final close.

The Linux kernel CVE team has assigned CVE-2026-64392 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.6.145 with commit f08b3f451f12eee4abd8a5981803bc36db84458b
	Fixed in 6.12.96 with commit 18c59109bb6fb816d5102171666f87cf1e29901d
	Fixed in 6.18.39 with commit e72c15085b6d86f45d224d98aa75b5cace4aaab9
	Fixed in 7.1.4 with commit 4b7059974549d278e30fe70e2a4e421f9839817d
	Fixed in 7.2-rc1 with commit 52e2f21911158ec961cd5aae19c56460db382af0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64392
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/server/vfs.c
	fs/smb/server/vfs_cache.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b
	https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d
	https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9
	https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d
	https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0