CVE-2026-64399 - Vulnerability Details

- ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the
destination file's data via vfs_clone_file_range() with neither the
share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle
fp->daccess check that the other write-bearing arms carry. A client can
overwrite destination data on a read-only share, or from a handle opened
with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).
FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via
the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;
require FILE_WRITE_DATA since this writes data.

Published: 2026-07-25

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ksmbd component of the Linux kernel incorrectly allows the FSCTL_DUPLICATE_EXTENTS_TO_FILE ioctl to call vfs_clone_file_range without enforcing the share‑level writable flag or per‑handle access checks. This flaw lets a client connected to an SMB share overwrite the contents of a target file even when the share is read‑only or the file handle is opened only with FILE_WRITE_ATTRIBUTES, effectively granting unauthorized write capability. The vulnerability is an instance of the improper authorization weakness CWE‑250 and can lead to data corruption and integrity loss on the affected system.

Affected Systems

All Linux kernel releases that expose the ksmbd SMB2 server daemon and support the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation are affected until the permission‑check patch is applied. The patch was introduced in a commit that added writable‑flag and per‑handle checks; any kernel incorporating that commit is no longer vulnerable.

Risk and Exploitability

The CVSS score of 9.8 signals a critical severity, but the EPSS score of <1% indicates low current exploitation probability, and the flaw is not listed in CISA's KEV catalog. Attackers can exploit the vulnerability by sending a specially crafted FSCTL_DUPLICATE_EXTENTS_TO_FILE request over an SMB network connection, with no need for elevated host privileges. Despite the low exploitation likelihood, the potential for silent data overwrite warrants prompt remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`eb817368f50c1cbe1bd07044124aad7db6330e3a`	affected	< bf460ad5958d506492de4524a656439da3f99c51
`eb817368f50c1cbe1bd07044124aad7db6330e3a`	affected	< 620d133d469295ee7c017ca6aafac335f65c4a5a
`eb817368f50c1cbe1bd07044124aad7db6330e3a`	affected	< 9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6
`eb817368f50c1cbe1bd07044124aad7db6330e3a`	affected	< baae7b39673ec21073a25e3d14f8feaada01d5df
`eb817368f50c1cbe1bd07044124aad7db6330e3a`	affected	< c917e4522d251071dde9871b9142d8ea1186ebfe
`eb817368f50c1cbe1bd07044124aad7db6330e3a`	affected	< 388e4139db27a9e3612c9d356b826f5b1ff6a9e3

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bf460ad5958d506492de4524a656439da3f99c51)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,620d133d469295ee7c017ca6aafac335f65c4a5a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,baae7b39673ec21073a25e3d14f8feaada01d5df)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c917e4522d251071dde9871b9142d8ea1186ebfe)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,388e4139db27a9e3612c9d356b826f5b1ff6a9e3)`	affected	code_commit	—
`[0,6.1.178)`	affected	generic	—
`[0,6.6.145)`	affected	generic	—
`[0,6.12.96)`	affected	generic	—
`[0,6.18.39)`	affected	generic	—
`[0,7.1.4)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ksmbd permission‑check patch (any release following the commit that added the checks).
Restrict SMB service exposure to trusted networks and remove or disable shares that should remain read‑only, ensuring that write‑able shares are protected with correct FILE_WRITE_DATA permissions.
Configure SELinux or AppArmor to limit the use of the FSCTL_DUPLICATE_EXTENTS_TO_FILE ioctl to privileged processes or specific users, and monitor SMB logs for unexpected use of this ioctl.

Generated by OpenCVE AI on August 3, 2026 at 18:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00491.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3
https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a
https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6
https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df
https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51
https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe
https://lore.kernel.org/linux-cve-announce/2026072529-CVE-2026-64399-4ae6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64399
https://www.cve.org/CVERecord?id=CVE-2026-64399

History

Thu, 30 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-250
References		https://lore.kernel.org/linux-cve-announce/2026072529-CVE-2026-64399-4ae6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64399 https://www.cve.org/CVERecord?id=CVE-2026-64399

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the destination file's data via vfs_clone_file_range() with neither the share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle fp->daccess check that the other write-bearing arms carry. A client can overwrite destination data on a read-only share, or from a handle opened with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp). FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix; require FILE_WRITE_DATA since this writes data.
Title		ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3 https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6 https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51 https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:42.925Z

Updated: 2026-08-05T12:41:37.295Z

Reserved: 2026-07-19T15:36:31.785Z

Link: CVE-2026-64399

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:23.397

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64399

Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64399 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T19:00:05Z

Weaknesses

CWE-250
Execution with Unnecessary Privileges

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object