Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) could allow users to modify file attributes on network shares they should only be able to read. ksmbd is a kernel-level module that allows Linux systems to share files with Windows and other devices over a network. An attacker with access to a read-only share could change a file's 'sparse' attribute, potentially interfering with storage management or bypassing intended security restrictions on file modifications.
Technical details
A permission bypass vulnerability exists in the ksmbd module of the Linux kernel within the fsctl_set_sparse() function. The implementation of the FSCTL_SET_SPARSE control code modifies a file's sparse attribute and saves it via extended attributes (xattr) without verifying if the underlying share is writable or if the user handle possesses FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES permissions. This allows a remote authenticated attacker to modify file attributes even on shares explicitly configured as read-only. The fix introduces mandatory checks for KSMBD_TREE_CONN_FLAG_WRITABLE at the share level and handle-level access checks before applying attribute changes.
Affected products
- Linux Linux Kernel 5.15 to 6.18.35, 7.0.12
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory