In the Linux kernel’s ksmbd service, alternate data streams are stored via extended attributes. The read and write paths for these streams call VFS xattr helpers that incorrectly recheck inode permissions and LSM policy using the current task’s credentials instead of the credentials captured when the SMB handle was opened. This flaw allows an attacker to bypass standard file permission checks and LSM enforcement on ADS operations, leading to improper privilege or access control (CWE‑250) and potentially enabling full control over file metadata and system configuration.

The defect exists in any Linux kernel that incorporates an unpatched ksmbd implementation and has the service enabled. All distributions shipping such a kernel, regardless of vendor, are potentially affected. No specific kernel versions are listed in the CNA data; thus the vulnerability remains until the patch is applied.

The EPSS score of less than 1 % indicates a low probability of exploitation under typical conditions, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the CVSS score of 9.8 denotes a severe impact if successfully abused. The likely attack vector is a remote SMB connection that grants the attacker a handle to the target system; once established, privileged ADS read or write operations can be performed, elevating the attacker’s privileges and allowing manipulation of sensitive file metadata or system configuration.