CVE-2026-64395: ksmbd: require source read access for duplicate extents

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-25 · updated 2026-09-04

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an attacker-readable destination. Require FILE_READ_DATA on the source handle before either VFS operation, matching other ksmbd data-copy paths.

Affected products

Linux kernel: from 5.15 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4 — fixed in 6.1.178, 6.12.96, 6.18.39, 6.6.145, 7.1.4

How to fix

Upgrade to a fixed version: Linux kernel 6.1.178, 6.12.96, 6.18.39, 6.6.145. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64395 or the next vulnerability affects your stack