CVE-2026-64391

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

An attacker reaches the vulnerable ADS read and write paths through SMB2 requests to an exposed ksmbd server over TCP/445.

AC:LAttack complexity, low

Exploitation is deterministic using an ADS handle followed by ordinary SMB2 READ or WRITE requests; no race, memory-layout dependency, or condition outside the attacker's control is required.

PR:NPrivileges required, none

Although a valid session, tree connection, and handle are required, a guest-enabled streams share permits a remote client to establish the necessary guest session without supplying valid credentials.

UI:NUser interaction, none

The attacker directly opens and accesses the alternate data stream through SMB requests without requiring any victim action.

S:UScope, unchanged

The credential bypass affects ADS data managed by the same host kernel and filesystem security authority; it does not cross a virtualization or comparable isolation boundary.

C:HConfidentiality impact, high

Privileged worker credentials can bypass inode and LSM xattr checks and disclose the complete contents of an attacker-selected named stream, including potentially sensitive application data.

I:HIntegrity impact, high

The vulnerable write path can bypass xattr authorization and replace or truncate the complete named stream with attacker-controlled data.

A:HAvailability impact, high

Repeated unauthorized truncation or corruption can persistently destroy an ADS and render applications or services that depend on that stream unusable until the data is restored.