The Linux kernel's ksmbd module had a vulnerability (CVE-2026-64398) where the FSCTL_SET_ZERO_DATA ioctl operation did not enforce per-handle access checks properly. Specifically, a handle opened with only FILE_WRITE_ATTRIBUTES permission was able to invoke vfs_fallocate with FMODE_WRITE flags to zero file data, bypassing intended access restrictions. This was due to the absence of a check on the file pointer's daccess permissions, allowing unauthorized data modification. The vulnerability was reproducible on mainline kernel 7.1-rc7 with KASAN by an authenticated SMB client. The fix requires that FSCTL_SET_ZERO_DATA operations demand FILE_WRITE_DATA permission, aligning with the fact that this operation modifies file data rather than attributes.

An authenticated SMB client with insufficient permissions (FILE_WRITE_ATTRIBUTES but not FILE_WRITE_DATA) could destroy file data by zeroing it out, potentially leading to data loss or corruption. This bypasses intended access control mechanisms in the ksmbd SMB server implementation within the Linux kernel.

A fix has been implemented in the Linux kernel to add the missing permission check for FSCTL_SET_ZERO_DATA, requiring FILE_WRITE_DATA permission for this operation. Users should apply the official kernel update that includes this patch. Since no patch links or vendor advisories are provided here, check the Linux kernel mainline or distribution vendor advisories for the relevant fix. Patch status is not yet confirmed in this data—verify with vendor sources for current remediation guidance.