The Linux kernel's ksmbd SMB2 server had a security flaw where the SMB2 SET_INFO SECURITY operation did not enforce the necessary WRITE_DAC or WRITE_OWNER permission checks on file handles. While other SMB2 SET_INFO operations verify handle-level access rights before modifying file metadata, the SECURITY arm called set_info_sec() without verifying if the handle had the appropriate permissions. This allowed a client holding only FILE_WRITE_ATTRIBUTES permission to rewrite the file's discretionary access control list (DACL) and owner, effectively escalating privileges on the file. The vulnerability was fixed by adding the required WRITE_DAC/WRITE_OWNER checks to the SMB2 SET_INFO SECURITY code path, ensuring that only authorized handles can modify security descriptors.

An attacker with a handle possessing only FILE_WRITE_ATTRIBUTES permission could exploit this vulnerability to modify file ownership and access control lists, thereby escalating their privileges on the affected file. This could lead to unauthorized access or control over files by bypassing intended permission restrictions. The vulnerability affects the integrity and access control enforcement of the SMB2 server implementation in the Linux kernel.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to SMB2 shares and monitor for unusual permission changes. Once a patch is released, apply it promptly to ensure the WRITE_DAC/WRITE_OWNER permission checks are enforced on SMB2 SET_INFO SECURITY operations.