PT-2026-64619 · Linux · Linux
CVE-2026-64398
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add a permission check for FSCTL SET ZERO DATA
FSCTL SET ZERO DATA in smb2 ioctl() destroys file data via
ksmbd vfs zero data() -> vfs fallocate(PUNCH HOLE/ZERO RANGE) after
checking only the share-level KSMBD TREE CONN FLAG WRITABLE, with no
per-handle access check. A handle opened with only FILE WRITE ATTRIBUTES
still yields an FMODE WRITE filp (FILE WRITE ATTRIBUTES is part of
FILE WRITE DESIRE ACCESS LE, so smb2 create open flags() opens it
O WRONLY), so the vfs fallocate FMODE WRITE check does not stop it; only
the missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with
KASAN by an authenticated SMB client: a FILE WRITE ATTRIBUTES-only handle
zeroed 4096 bytes of file data it had no FILE WRITE DATA right to
(6/6; a FILE READ DATA-only handle was correctly denied).
This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL
permission bypass by adding a permission check for FSCTL SET SPARSE").
Because SET ZERO DATA writes data (not an attribute), require
FILE WRITE DATA.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux