CVE-2026-64400

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: prevent path traversal bypass by restricting caseless retry<br /> <br /> ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path<br /> resolution within the share root. When a crafted path attempts to<br /> escape the share boundary using parent-directory components (&amp;#39;..&amp;#39;),<br /> vfs_path_parent_lookup() detects this and immediately fails,<br /> returning -EXDEV.<br /> <br /> However, a bug exists in __ksmbd_vfs_kern_path() under caseless mode.<br /> The function fails to intercept the -EXDEV error and erroneously<br /> falls through to the caseless retry logic, which is intended only<br /> for genuinely missing files. During this retry process, the path<br /> is reconstructed, leading to an unintended LOOKUP_BENEATH bypass<br /> that allows write-capable users to create zero-length files or<br /> directories outside the exported share.<br /> <br /> Fix this by ensuring that the execution only proceeds to the caseless<br /> lookup retry when the error is specifically -ENOENT. Any other errors,<br /> such as -EXDEV from a path traversal attempt, must be returned immediately.