CVE-2026-64395

ksmbd: require source read access for duplicate extents

State: Published
Severity: 7.5 High
Published: Jul 25, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: require source read access for duplicate extents

FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an attacker-readable destination.

Require FILE_READ_DATA on the source handle before either VFS operation, matching other ksmbd data-copy paths.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	eb817368f50c1cbe1bd07044124aad7db6330e3a to before 2d2ab6983620c2d60ce7db72133984ca3873b929Affected eb817368f50c1cbe1bd07044124aad7db6330e3a to before 67bdad9cf01b25030e3bf00bbce6c309319d6663Affected eb817368f50c1cbe1bd07044124aad7db6330e3a to before b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5fAffected eb817368f50c1cbe1bd07044124aad7db6330e3a to before db231af842868268839f9f9619c68cb27830d8beAffected eb817368f50c1cbe1bd07044124aad7db6330e3a to before a10942af27832c2761d020863a46e79bebe0567dAffected eb817368f50c1cbe1bd07044124aad7db6330e3a to before cedff600f1642aa982178503552f0d007bc829c8Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

eb817368f50c1cbe1bd07044124aad7db6330e3a to before 2d2ab6983620c2d60ce7db72133984ca3873b929Affected
eb817368f50c1cbe1bd07044124aad7db6330e3a to before 67bdad9cf01b25030e3bf00bbce6c309319d6663Affected
eb817368f50c1cbe1bd07044124aad7db6330e3a to before b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5fAffected
eb817368f50c1cbe1bd07044124aad7db6330e3a to before db231af842868268839f9f9619c68cb27830d8beAffected
eb817368f50c1cbe1bd07044124aad7db6330e3a to before a10942af27832c2761d020863a46e79bebe0567dAffected
eb817368f50c1cbe1bd07044124aad7db6330e3a to before cedff600f1642aa982178503552f0d007bc829c8Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.