Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) could allow an attacker to bypass file access restrictions. By using a specific file-copying command, an attacker could copy data from a file they only have permission to see the attributes of into a file they can fully read. This could lead to the unauthorized exposure of sensitive file contents.
Technical details
A vulnerability in ksmbd was identified where FSCTL_DUPLICATE_EXTENTS_TO_FILE requests did not verify if the source file handle possessed FILE_READ_DATA permissions. The request would pass the source file directly to vfs_clone_file_range() or vfs_copy_file_range() based only on attribute access. An attacker with a handle opened for attribute access could exploit this to copy protected file contents into a destination file they control and can read. The fix introduces a mandatory check for FILE_READ_DATA on the source handle before allowing the VFS operation.
Affected products
- Linux Linux Kernel 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-07-25: advisory: CVE-2026-64395 published by NVD
- 2026-07-24: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/2d2ab6983620c2d60ce7db72133984ca3873b929
- https://git.kernel.org/stable/c/67bdad9cf01b25030e3bf00bbce6c309319d6663
- https://git.kernel.org/stable/c/a10942af27832c2761d020863a46e79bebe0567d
- https://git.kernel.org/stable/c/b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f
- https://git.kernel.org/stable/c/cedff600f1642aa982178503552f0d007bc829c8
- https://git.kernel.org/stable/c/db231af842868268839f9f9619c68cb27830d8be