CVE-2026-64399: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE
The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl() overwrites the destination file's data via vfsclonefilerange() with neither the share-level KSMBDTREECONNFLAGWRITABLE check nor a per-handle fp->daccess check that the other write-bearing arms carry. A client can overwrite destination data on a read-only share, or from a handle opened with only FILEWRITEATTRIBUTES (which still yields an FMODEWRITE filp). FILEWRITEATTRIBUTES-only destination handle overwrote the file's data via the clone. Add both checks, matching the FSCTLSETSPARSE permission fix; require FILEWRITEDATA since this writes data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure ksmbd performs the necessary permission checks for the smb2_ioctl FSCTL_DUPLICATE_EXTENTS_TO_FILE arm so it cannot overwrite destination data when the destination is on a read-only share or when the handle is opened with only FILE_WRITE_ATTRIBUTES; require FILE_WRITE_DATA since the operation writes data.
ksmbd (SMB server) permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE = require FILE_WRITE_DATA (not only FILE_WRITE_ATTRIBUTES) for handles performing FSCTL_DUPLICATE_EXTENTS_TO_FILE
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64399?
CVE-2026-64399 has a critical severity rating of 9.8 according to the CVSS 3.1 scoring system.
How do I fix CVE-2026-64399?
To fix CVE-2026-64399, update to the latest version of the Linux kernel that includes the appropriate patches for this vulnerability.
What impact does CVE-2026-64399 have?
CVE-2026-64399 allows attackers to overwrite a destination file's data, potentially leading to data loss or corruption.
Which software is affected by CVE-2026-64399?
CVE-2026-64399 affects the Linux kernel, specifically in the ksmbd component related to SMB file sharing.
Is CVE-2026-64399 actively exploited?
As of the latest updates, there are no public reports indicating active exploitation of CVE-2026-64399.