In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in… (CVE-2026-64398)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES still yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of FILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it O_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only the missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with KASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle zeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to (6/6; a FILE_READ_DATA-only handle was correctly denied). This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE"). Because SET_ZERO_DATA writes data (not an attribute), require FILE_WRITE_DATA.
AI Analysis
Technical Summary
The Linux kernel's ksmbd module had a vulnerability (CVE-2026-64398) where the FSCTL_SET_ZERO_DATA ioctl operation did not enforce per-handle access checks properly. Specifically, a handle opened with only FILE_WRITE_ATTRIBUTES permission was able to invoke vfs_fallocate with FMODE_WRITE flags to zero file data, bypassing intended access restrictions. This was due to the absence of a check on the file pointer's daccess permissions, allowing unauthorized data modification. The vulnerability was reproducible on mainline kernel 7.1-rc7 with KASAN by an authenticated SMB client. The fix requires that FSCTL_SET_ZERO_DATA operations demand FILE_WRITE_DATA permission, aligning with the fact that this operation modifies file data rather than attributes.
Potential Impact
An authenticated SMB client with insufficient permissions (FILE_WRITE_ATTRIBUTES but not FILE_WRITE_DATA) could destroy file data by zeroing it out, potentially leading to data loss or corruption. This bypasses intended access control mechanisms in the ksmbd SMB server implementation within the Linux kernel.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add the missing permission check for FSCTL_SET_ZERO_DATA, requiring FILE_WRITE_DATA permission for this operation. Users should apply the official kernel update that includes this patch. Since no patch links or vendor advisories are provided here, check the Linux kernel mainline or distribution vendor advisories for the relevant fix. Patch status is not yet confirmed in this data—verify with vendor sources for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in… (CVE-2026-64398)
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES still yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of FILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it O_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only the missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with KASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle zeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to (6/6; a FILE_READ_DATA-only handle was correctly denied). This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE"). Because SET_ZERO_DATA writes data (not an attribute), require FILE_WRITE_DATA.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ksmbd module had a vulnerability (CVE-2026-64398) where the FSCTL_SET_ZERO_DATA ioctl operation did not enforce per-handle access checks properly. Specifically, a handle opened with only FILE_WRITE_ATTRIBUTES permission was able to invoke vfs_fallocate with FMODE_WRITE flags to zero file data, bypassing intended access restrictions. This was due to the absence of a check on the file pointer's daccess permissions, allowing unauthorized data modification. The vulnerability was reproducible on mainline kernel 7.1-rc7 with KASAN by an authenticated SMB client. The fix requires that FSCTL_SET_ZERO_DATA operations demand FILE_WRITE_DATA permission, aligning with the fact that this operation modifies file data rather than attributes.
Potential Impact
An authenticated SMB client with insufficient permissions (FILE_WRITE_ATTRIBUTES but not FILE_WRITE_DATA) could destroy file data by zeroing it out, potentially leading to data loss or corruption. This bypasses intended access control mechanisms in the ksmbd SMB server implementation within the Linux kernel.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add the missing permission check for FSCTL_SET_ZERO_DATA, requiring FILE_WRITE_DATA permission for this operation. Users should apply the official kernel update that includes this patch. Since no patch links or vendor advisories are provided here, check the Linux kernel mainline or distribution vendor advisories for the relevant fix. Patch status is not yet confirmed in this data—verify with vendor sources for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ch49-xqcg-99vv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64398"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420a9c2644c7f8084177
Added to database: 07/25/2026, 23:08:58 UTC
Last enriched: 07/25/2026, 23:26:59 UTC
Last updated: 09/07/2026, 10:52:10 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.