CVE-2026-64395: ksmbd: require source read access for duplicate extents
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: require source read access for duplicate extents
FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange() or vfscopyfilerange() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an attacker-readable destination.
Require FILEREADDATA on the source handle before either VFS operation, matching other ksmbd data-copy paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the fix described in the resolved Linux kernel update: require FILE_READ_DATA on the source handle before performing either VFS operation for ksmbd duplicate extents, ensuring source read access is checked prior to vfs_clone_file_range() / vfs_copy_file_range() paths.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running ksmbd are exposed when SMB clients can obtain a source-file handle with attribute access but without read-data permission. The issue affects confidentiality by allowing source contents to be copied into a destination the attacker can read.
What does an attacker need to exploit it?
An attacker needs network access to the SMB service and must be able to invoke FSCTL_DUPLICATE_EXTENTS_TO_FILE using a source handle that lacks FILE_READ_DATA but has attribute access. No prior privileges or user interaction are indicated by the CVSS vector.
What should be done if patching cannot happen immediately?
Restrict access to the ksmbd SMB service to trusted clients and prevent untrusted users from obtaining SMB handles to sensitive files. Limiting access to files containing sensitive data reduces the risk of their contents being copied to attacker-readable destinations.