PT-2026-64620 · Linux · Linux

CVE-2026-64399 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add permission checks for FSCTL DUPLICATE EXTENTS TO FILE

The FSCTL DUPLICATE EXTENTS TO FILE arm of smb2 ioctl() overwrites the destination file's data via vfs clone file range() with neither the share-level KSMBD TREE CONN FLAG WRITABLE check nor a per-handle fp->daccess check that the other write-bearing arms carry. A client can overwrite destination data on a read-only share, or from a handle opened with only FILE WRITE ATTRIBUTES (which still yields an FMODE WRITE filp). FILE WRITE ATTRIBUTES-only destination handle overwrote the file's data via the clone. Add both checks, matching the FSCTL SET SPARSE permission fix; require FILE WRITE DATA since this writes data.

Related Identifiers

CVE-2026-64399

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64399 · Security Note
• https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51 · Note
• https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe · Note
• https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3 · Note
• https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df · Note
• https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a · Note
• https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6 · Note