CVE-2026-64395

Awaiting Analysis Awaiting Analysis - Queue

ksmbd Duplicate Extents Handling Requires Source Read Access

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an attacker-readable destination. Require FILE_READ_DATA on the source handle before either VFS operation, matching other ksmbd data-copy paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64395

EUVD

EUVD-2026-48939

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's ksmbd component involves a flaw in handling file operations. When using FSCTL_DUPLICATE_EXTENTS_TO_FILE, the system copies file contents without verifying proper read access permissions on the source file. This allows an attacker to use a handle with limited access to copy sensitive data into a readable destination file.

Detection Guidance

This vulnerability affects the ksmbd component in the Linux kernel. Detection requires checking if your system uses a vulnerable kernel version. Use commands like 'uname -r' to check the kernel version and 'modinfo ksmbd' to verify if the module is loaded. If the kernel version is below the patched release, the system is likely vulnerable.

Impact Analysis

An attacker could exploit this to read sensitive files they shouldn't have access to by copying their contents into a file they can read. This could lead to unauthorized data exposure, information leaks, or potential privilege escalation depending on the system configuration.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to protected data. GDPR and HIPAA both mandate strict controls to prevent unauthorized data access or disclosure. Exploitation of this flaw could result in data breaches, leading to regulatory penalties, fines, or legal consequences for non-compliance.

Mitigation Strategies

Immediately update the Linux kernel to the latest patched version. If updating is not possible, disable the ksmbd module using 'modprobe -r ksmbd' to prevent exploitation. Ensure SMB access controls are properly configured to restrict unauthorized file operations.

Hi! I’m here to help you understand CVE-2026-64395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70