CVE-2026-52944: ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE
FSCTLSETSPARSE in fsctlsetsparse() modifies the file's sparse attribute and saves it through xattr without any permission checks.
This exposes two issues:
1) A client on a read-only share can change the sparse attribute on files it opened, even though the share is read-only. Other FSCTL write operations already check testtreeconnflag(work->tcon, KSMBDTREECONNFLAGWRITABLE), but FSCTLSETSPARSE does not.
2) Even on writable shares, clients without FILEWRITEDATA or FILEWRITEATTRIBUTES access should not modify the sparse attribute. Similar handle-level checks exist in other functions but are missing here.
Add both share-level writable check and per-handle access check. Use goto out on error to avoid leaking file references.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Add a share-level writable check using test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE) before allowing FSCTL_SET_SPARSE to modify the file's sparse attribute.
ksmbd KSMBD_TREE_CONN_FLAG_WRITABLE (share-level writable check) = required for allowing FSCTL_SET_SPARSE to modify sparse attributes - Configuration
Add per-handle access permission checks for FSCTL_SET_SPARSE in fsctl_set_sparse(): require FILE_WRITE_DATA (and ensure FILE_WRITE_ATTRIBUTES does not allow changing/saving the sparse attribute) before modifying sparse attributes.
ksmbd Per-handle access checks for FSCTL_SET_SPARSE = required - Configuration
Ensure fsctl_set_sparse() does not modify/save the sparse attribute when clients only have FILE_WRITE_ATTRIBUTES (no FILE_WRITE_DATA), and prevent sparse changes on read-only shares.
ksmbd Sparse attribute modification permission logic = FSCTL_SET_SPARSE must enforce permission checks and must not allow sparse changes via only FILE_WRITE_ATTRIBUTES - Compensating control
Use goto out on error to avoid leaking file references while implementing the FSCTL_SET_SPARSE permission checks in fsctl_set_sparse().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52944?
CVE-2026-52944 has been assessed with a risk score of 33.
How do I fix CVE-2026-52944?
To fix CVE-2026-52944, ensure that you update to the latest patched version of the Linux kernel that includes the fix for the FSCTL permission bypass.
What systems are affected by CVE-2026-52944?
CVE-2026-52944 affects systems running the Linux kernel with ksmbd functionality.
What is the nature of the vulnerability in CVE-2026-52944?
CVE-2026-52944 is a permission bypass vulnerability that allows unauthorized modification of a file's sparse attribute.
What does FSCTL_SET_SPARSE refer to in CVE-2026-52944?
In CVE-2026-52944, FSCTL_SET_SPARSE refers to a control code used to modify a file's sparse attribute without appropriate permission checks.