An authenticated SMB client can send the FSCTL_SET_ZERO_DATA command to the ksmbd SMB server in the Linux kernel. The kernel implementation performs a share‑level writable check but does not enforce a per‑handle FILE_WRITE_DATA permission. Consequently a handle opened with only FILE_WRITE_ATTRIBUTES rights, which still grants a writable file descriptor, permits the underlying vfs_fallocate call to zero out arbitrary portions of a file. The flaw therefore allows a malicious client to permanently erase file data without the required write‑data privilege, resulting in data loss.

All Linux kernels that include the ksmbd SMB server component but lack the commit adding the permission check for FSCTL_SET_ZERO_DATA are vulnerable. The issue was demonstrated against mainline 7.1‑rc7 and applies to any kernel build that has not applied the relevant patch. Distribution kernels that incorporate the ksmbd module and have not updated to the fixed version remain at risk.

The vulnerability has a CVSS score of 8.1, indicating a high impact. Its EPSS score is less than 1% and it is not listed in the CISA KEV catalog, which suggests that exploitation is currently unlikely to be widespread. The attack requires only an authenticated SMB client; no local privileges are necessary. Once exploited, a single malicious FSCTL_SET_ZERO_DATA request can permanently erase data from any file that the compromised user has write‑attribute rights. The risk is therefore high until the kernel is updated to a version that includes the permission check.