In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The… (CVE-2026-64399)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the destination file's data via vfs_clone_file_range() with neither the share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle fp->daccess check that the other write-bearing arms carry. A client can overwrite destination data on a read-only share, or from a handle opened with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp). FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix; require FILE_WRITE_DATA since this writes data.
AI Analysis
Technical Summary
The Linux kernel's ksmbd smb2_ioctl() function's FSCTL_DUPLICATE_EXTENTS_TO_FILE operation previously permitted overwriting destination file data via vfs_clone_file_range() without enforcing share-level writable flags or per-handle write access checks. This omission allowed clients to overwrite files on read-only shares or with handles opened with only FILE_WRITE_ATTRIBUTES, which should not permit data writes. The fix introduces both share-level and per-handle permission checks, aligning with the FSCTL_SET_SPARSE permission model, and mandates FILE_WRITE_DATA access for the clone operation.
Potential Impact
Clients could overwrite file data on read-only SMB shares or via handles that should not have write permissions, potentially leading to unauthorized data modification. This could compromise data integrity on affected systems running vulnerable Linux kernel versions with ksmbd enabled.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add the missing permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE in ksmbd. Users should apply the official kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the current remediation guidance and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The… (CVE-2026-64399)
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the destination file's data via vfs_clone_file_range() with neither the share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle fp->daccess check that the other write-bearing arms carry. A client can overwrite destination data on a read-only share, or from a handle opened with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp). FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix; require FILE_WRITE_DATA since this writes data.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ksmbd smb2_ioctl() function's FSCTL_DUPLICATE_EXTENTS_TO_FILE operation previously permitted overwriting destination file data via vfs_clone_file_range() without enforcing share-level writable flags or per-handle write access checks. This omission allowed clients to overwrite files on read-only shares or with handles opened with only FILE_WRITE_ATTRIBUTES, which should not permit data writes. The fix introduces both share-level and per-handle permission checks, aligning with the FSCTL_SET_SPARSE permission model, and mandates FILE_WRITE_DATA access for the clone operation.
Potential Impact
Clients could overwrite file data on read-only SMB shares or via handles that should not have write permissions, potentially leading to unauthorized data modification. This could compromise data integrity on affected systems running vulnerable Linux kernel versions with ksmbd enabled.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add the missing permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE in ksmbd. Users should apply the official kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the current remediation guidance and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mrp6-592v-c3fh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64399"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420a9c2644c7f8083bd0
Added to database: 07/25/2026, 23:08:58 UTC
Last enriched: 07/25/2026, 23:26:08 UTC
Last updated: 09/08/2026, 22:52:14 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.