CVE-2026-64388

smb/client: fix chown/chgrp with SMB3 POSIX Extensions

State: Published
Severity: 7.8 High
Published: Jul 25, 2026
Updated: Oct 30, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix chown/chgrp with SMB3 POSIX Extensions

Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set.

Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-682 Incorrect Calculation

Affected Products

Product	Versions
LinuxLinux	b326614ea2159ea5c835d320f261d05d080cd201 to before c0fe1118a1471d459f76c3e70ff2abbf784ce6bfAffected b326614ea2159ea5c835d320f261d05d080cd201 to before 6825a45f6b8ef76b0ee32649ec3d6e39ca143a18Affected b326614ea2159ea5c835d320f261d05d080cd201 to before 27ead8c5418af6bfab711079fecb9414d78d4caeAffected b326614ea2159ea5c835d320f261d05d080cd201 to before 3eaec47518e126e6dcd1a48521d740278073f0ecAffected b326614ea2159ea5c835d320f261d05d080cd201 to before 550cfb8a81181331d4d0f76ab75ee58a0bf41e3eAffected b326614ea2159ea5c835d320f261d05d080cd201 to before 760ef2c579c2609cf17fb1cd5392f64d42d43d33Affected
LinuxLinux	4.18Affected before 4.18Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

b326614ea2159ea5c835d320f261d05d080cd201 to before c0fe1118a1471d459f76c3e70ff2abbf784ce6bfAffected
b326614ea2159ea5c835d320f261d05d080cd201 to before 6825a45f6b8ef76b0ee32649ec3d6e39ca143a18Affected
b326614ea2159ea5c835d320f261d05d080cd201 to before 27ead8c5418af6bfab711079fecb9414d78d4caeAffected
b326614ea2159ea5c835d320f261d05d080cd201 to before 3eaec47518e126e6dcd1a48521d740278073f0ecAffected
b326614ea2159ea5c835d320f261d05d080cd201 to before 550cfb8a81181331d4d0f76ab75ee58a0bf41e3eAffected
b326614ea2159ea5c835d320f261d05d080cd201 to before 760ef2c579c2609cf17fb1cd5392f64d42d43d33Affected

LinuxLinux

4.18Affected
before 4.18Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.