Homepage

Privilege Context Switching Error The advisory has been revoked - it doesn't affect any version of package rv  (opens in a new tab)

Threat Intelligence

EPSS
0.47% (38th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-RV-18420945
  • published30 Jul 2026
  • disclosed25 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 25 Jul 2026

NewCVE-2026-64392  (opens in a new tab)
CWE-270  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rv package and not the rv package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use opener credentials for delete-on-close

Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks.

Run both operations with the credentials captured in struct file when the handle was opened. This preserves the authenticated user's fsuid, fsgid, supplementary groups and capability restrictions at final close.