What is CVE-2026-64400?

CVE-2026-64400 is a High severity Linux kernel vulnerability with a CVSS score of 8.6 out of 10, affecting Linux kernel versions from 5.15.145 onward and patched in 7.1.4 and 7.2. CVE-2026-64400 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-64400?

CVE-2026-64400 has a CVSS score of 8.6 out of 10, rated High severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.

Is there a patch available for CVE-2026-64400?

Yes, CVE-2026-64400 has been patched. Fixed versions include 7.1.4 and 7.2. If you are running Linux kernel 5.15.145 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-64400 actively exploited?

CVE-2026-64400 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-64400

High

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using parent-directory components ('..'), vfs_path_parent_lookup() detects this and immediately fails, returning -EXDEV. However, a bug exists in __ksmbd_vfs_kern_path() under caseless mode. The function fails to intercept the -EXDEV error and erroneously falls through to the caseless retry logic, which is intended only for genuinely missing files. During this retry process, the path is reconstructed, leading to an unintended LOOKUP_BENEATH bypass that allows write-capable users to create zero-length files or directories outside the exported share. Fix this by ensuring that the execution only proceeds to the caseless lookup retry when the error is specifically -ENOENT. Any other errors, such as -EXDEV from a path traversal attempt, must be returned immediately.

Package Linux Kernel

Published 2026-07-25

Last modified 2026-09-04

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

8.6

out of 10

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected versions

Linux kernel versions 5.15.145, 6.1.71, 6.3.10, 6.4 and later are affected. Fixed in 7.1.4, 7.2 and their respective stable series.

Affected from

≥ 5.15.145 ≥ 6.1.71 ≥ 6.3.10 ≥ 6.4

Fixed in

✓ 7.1.4 7.1.x ✓ 7.2

References

2 total

Kernel Git
https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95

Patch
Kernel Git
https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67

Patch

Details

CVE ID CVE-2026-64400

Severity High

CVSS score 8.6 / 10

CVSS version 3.1

Published 2026-07-25

Modified 2026-09-04

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-64400?

CVE-2026-64400 is a High severity Linux kernel vulnerability with a CVSS score of 8.6 out of 10 . It affects Linux kernel versions from 5.15.145 onward and has been patched in 7.1.4 and 7.2. CVE-2026-64400 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-64400?

CVE-2026-64400 has a CVSS score of 8.6 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.
Is there a patch available for CVE-2026-64400?

Yes. CVE-2026-64400 has been patched. Fixed versions include 7.1.4 and 7.2. If you are running Linux kernel 5.15.145 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-64400 actively exploited?

No. CVE-2026-64400 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.