CVE-2026-64399
A flaw in the Linux kernel’s SMB server (ksmbd) allowed attackers to overwrite files on a read‑only share or with limited write permissions. The issue was fixed by adding missing permission checks for the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel systems that run the ksmbd SMB server component before the patch, regardless of distribution.
Real-world impact
An attacker could overwrite or corrupt files on a Linux system that runs ksmbd, potentially leading to data loss or privilege escalation.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network‑exploitable, requires no user interaction, and allows an attacker to compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Update the Linux kernel to a version that includes the ksmbd permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.