CVE-2026-52944

ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

Published Jun 24, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

FSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file's sparse
attribute and saves it through xattr without any permission checks.

This exposes two issues:

1) A client on a read-only share can change the sparse attribute
on files it opened, even though the share is read-only.
Other FSCTL write operations already check
test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE),
but FSCTL_SET_SPARSE does not.

2) Even on writable shares, clients without FILE_WRITE_DATA or
FILE_WRITE_ATTRIBUTES access should not modify the sparse
attribute. Similar handle-level checks exist in other functions
but are missing here.

Add both share-level writable check and per-handle access check.
Use goto out on error to avoid leaking file references.

Analysis

Technical impact

The Linux kernel’s ksmbd server had an omission in its handling of the FSCTL_SET_SPARSE control code: the routine that applies the sparse flag to a file wrote the change to extended attributes without any permission checks. As a result, a SMB client that could send the FSCTL_SET_SPARSE request could alter a file’s sparse attribute even when the share is set to read‑only or when the client does not hold FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES rights. This flaw enables an attacker to change file metadata and disk usage characteristics without proper authorization, and it is rooted in improper access control (CWE‑266).

Affected Systems

All Linux kernel installations that run the ksmbd SMB server are affected. The flaw is present wherever the unpatched implementation of FSCTL_SET_SPARSE resides, regardless of distribution or specific kernel version, because the patch is made to core ksmbd code used by all enabled SMB services.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score is below 1%, reflecting a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack path is straightforward for any SMB client that can send the FSCTL_SET_SPARSE command. As a result, an attacker can modify file attributes without proper authorization, potentially impacting data integrity and system stability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< ef664475c1bf1a27d45dae6848ca9c9c4d86853f
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 3a9a0a1c38ef90788f5d7c4b29903c8b220f744a
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< 3127a884525dc8ca4def73254bfcd3ccef0bf812
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< c5ab11263e3c89aa7989afc5374ef7743e092fd0
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< de9eb0b44fa9123170e6245b49638e0e453c10f8
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< aef151bcfa494bfe983669de2726734b534adb73
`e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9`	affected	< cc57232cae23c0df91b4a59d0f519141ce9b5b02

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,3127a884525dc8ca4def73254bfcd3ccef0bf812)`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,de9eb0b44fa9123170e6245b49638e0e453c10f8)`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,aef151bcfa494bfe983669de2726734b534adb73)`	affected	code_commit	—
`[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,cc57232cae23c0df91b4a59d0f519141ce9b5b02)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the ksmbd FSCTL_SET_SPARSE permission‑check patch
If an immediate kernel upgrade is not feasible, configure SMB shares to be read‑only or enforce proper FILE_WRITE_DATA/FILE_WRITE_ATTRIBUTES permissions in smb.conf so that only authorized clients can issue write operations
Configure or disable SMB support for FSCTL_SET_SPARSE (if the SMB server configuration allows disabling this control code) to prevent clients from attempting to modify sparse attributes

Generated by OpenCVE AI on August 12, 2026 at 05:25 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8903-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8904-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8905-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8903-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8905-2	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.122% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3127a884525dc8ca4def73254bfcd3ccef0bf812
https://git.kernel.org/stable/c/3a9a0a1c38ef90788f5d7c4b29903c8b220f744a
https://git.kernel.org/stable/c/aef151bcfa494bfe983669de2726734b534adb73
https://git.kernel.org/stable/c/c5ab11263e3c89aa7989afc5374ef7743e092fd0
https://git.kernel.org/stable/c/cc57232cae23c0df91b4a59d0f519141ce9b5b02
https://git.kernel.org/stable/c/de9eb0b44fa9123170e6245b49638e0e453c10f8
https://git.kernel.org/stable/c/ef664475c1bf1a27d45dae6848ca9c9c4d86853f
https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-52944-03d6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52944
https://www.cve.org/CVERecord?id=CVE-2026-52944

History

Sep 14, 2026 12:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3a9a0a1c38ef90788f5d7c4b29903c8b220f744a https://git.kernel.org/stable/c/c5ab11263e3c89aa7989afc5374ef7743e092fd0 https://git.kernel.org/stable/c/ef664475c1bf1a27d45dae6848ca9c9c4d86853f

Jun 25, 2026 2:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-285 CWE-306

Jun 25, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-266
References		https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-52944-03d6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52944 https://www.cve.org/CVERecord?id=CVE-2026-52944

Jun 24, 2026 2:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-285 CWE-306

Jun 24, 2026 10:15 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE FSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file's sparse attribute and saves it through xattr without any permission checks. This exposes two issues: 1) A client on a read-only share can change the sparse attribute on files it opened, even though the share is read-only. Other FSCTL write operations already check test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE), but FSCTL_SET_SPARSE does not. 2) Even on writable shares, clients without FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES access should not modify the sparse attribute. Similar handle-level checks exist in other functions but are missing here. Add both share-level writable check and per-handle access check. Use goto out on error to avoid leaking file references.
Title		ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3127a884525dc8ca4def73254bfcd3ccef0bf812 https://git.kernel.org/stable/c/aef151bcfa494bfe983669de2726734b534adb73 https://git.kernel.org/stable/c/cc57232cae23c0df91b4a59d0f519141ce9b5b02 https://git.kernel.org/stable/c/de9eb0b44fa9123170e6245b49638e0e453c10f8