CVE-2026-64379 is a trust boundary violation in the Linux kernel's SMB client. When the modefromsid feature is enabled, the client accepts the server's supplied permission bits from sub_auth[2] and applies them directly to files created on the local filesystem — without masking to the standard 07777 bitmask that constrains local file operations.
The 07777 mask is not arbitrary. It explicitly preserves setuid, setgid, and sticky bits while rejecting anything outside Unix permission range. The kernel already applies this mask on the read path — when a client reads a file from an SMB server, garbage permission bits are sanitized before touching local state. That same constraint was absent in parse_dacl, the code path that constructs local file metadata from server-provided ACL data during file creation. The fix adds the same 07777 mask to that write path.
What makes this significant is the deployment context. Modefromsid is typically enabled in mixed Windows/Linux environments where NTFS ACLs need to translate to Unix permissions. In those environments, the SMB server is often a domain controller or file server that already sits inside the trust boundary. Enabling modefromsid is itself a decision to trust that server with local permission decisions — but this CVE means that server can push those decisions further than intended. A compromised or malicious SMB server could set permission bits that grant execute permissions unexpectedly, or potentially setuid behavior that facilitates privilege escalation on the client.
The CVSS 7.1 underweights this. The read-path masking proves the kernel's own threat model already accounted for malicious servers in one direction — the failure was that the same threat wasn't recognized for the inverse operation. In practice, the blast radius depends on whether modefromsid is enabled and how many clients mount that server's shares. A single compromised server in a large Active Directory environment could affect permissions across thousands of Linux clients simultaneously.
If you have modefromsid enabled, the immediate question is whether your kernel version includes the 07777 mask fix in parse_dacl. If patching is delayed or uncertain, consider whether the feature is necessary for your workload. The underlying design — treating a remote server as an authoritative source for local permission bits — is the class of vulnerability that has appeared repeatedly in NFS, FUSE, and now SMB permission translation. Masking sub_auth[2] closes this instance, but the architectural pattern that enabled it remains.