CVE-2026-64399 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the destination file's data via vfs_clone_file_range() with neither the share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle fp->daccess check that the other write-bearing arms carry. A client can overwrite destination data on a read-only share, or from a handle opened with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp). FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix; require FILE_WRITE_DATA since this writes data.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel affects the ksmbd implementation which provides SMB2/SMB3 server functionality for Linux systems. This security flaw resides within the smb2_ioctl() function's handling of the FSCTL_DUPLICATE_EXTENTS_TO_FILE control code, representing a critical permission bypass issue that undermines the fundamental security model of shared file systems. The vulnerability specifically impacts the ksmbd subsystem which enables Linux servers to function as SMB file servers, commonly used in enterprise environments for Windows file sharing compatibility.
The technical flaw stems from an incomplete implementation of access control checks within the FSCTL_DUPLICATE_EXTENTS_TO_FILE handler path. Unlike other write operations within the same smb2_ioctl() function that properly validate both share-level writability through KSMBD_TREE_CONN_FLAG_WRITABLE flags and per-handle access permissions via fp->daccess checks, this particular code path omits these essential security validations. The implementation uses vfs_clone_file_range() to perform the actual data overwriting operation without verifying whether the destination file can be modified according to the established permission model.
This vulnerability creates a significant operational impact by allowing unauthorized data modification in scenarios where such access should be prohibited. An attacker can exploit this flaw to overwrite data within files that reside on read-only shares, effectively bypassing the share-level protection mechanisms that are designed to prevent modifications to sensitive data. Additionally, the vulnerability permits overwriting of file contents even when the destination handle was opened with only FILE_WRITE_ATTRIBUTES permissions, which traditionally should not permit data modification operations. This represents a direct violation of the principle of least privilege and can lead to unauthorized data corruption or manipulation.
The security implications extend beyond simple data overwrite capabilities as this vulnerability can be leveraged for more sophisticated attacks within networked environments. The flaw demonstrates poor adherence to established security patterns, particularly when compared to similar fixes implemented for FSCTL_SET_SPARSE operations that correctly enforce the necessary permission checks. The fix requires implementing both share-level writability validation and per-handle access control verification, specifically demanding FILE_WRITE_DATA permissions since the operation fundamentally writes data to target files rather than merely modifying attributes.
This vulnerability aligns with CWE-284 Access Control Issues, specifically addressing insufficient authorization checks within kernel-level file system operations. The flaw maps to ATT&CK technique T1070.004 Indicator Removal on Host related to maintaining access through unauthorized modifications of data. Organizations using ksmbd for SMB file sharing services should prioritize immediate patching as the vulnerability enables attackers to bypass existing share permissions and handle-based access controls, potentially leading to data integrity compromise across shared network resources. The fix implementation follows established security patterns that ensure consistent permission validation across all write-bearing operations within the SMB2 protocol handler.