Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) could allow unauthorized users to overwrite files. This occurs because the server fails to properly check permissions when a client requests to duplicate file data. As a result, an attacker could modify files even on network shares that are supposed to be read-only, potentially leading to data corruption or loss.
Technical details
A permission bypass vulnerability exists in the ksmbd component of the Linux kernel within the smb2_ioctl() function. The FSCTL_DUPLICATE_EXTENTS_TO_FILE handler fails to validate the KSMBD_TREE_CONN_FLAG_WRITABLE share-level flag and the fp->daccess per-handle permissions before calling vfs_clone_file_range(). This allows a remote attacker with a handle opened with minimal permissions (such as FILE_WRITE_ATTRIBUTES) or access to a read-only share to overwrite destination file data. The fix introduces mandatory checks for both the writable tree connection flag and the FILE_WRITE_DATA permission on the destination handle. Patches have been released for multiple stable kernel branches including 6.1.y, 6.6.y, 6.12.y, 6.18.y, and 7.1.y.
Affected products
- Linux Linux Kernel 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-07-25: advisory: CVE-2026-64399 published by NVD
- 2026-06-16: patched: Fix committed to Linux stable tree
References
- https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3
- https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a
- https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6
- https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df
- https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51
- https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe