CVE-2026-64398

kernel: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

Loading…

Severity

Important

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · July 25, 2026

Updated · October 20, 2026

Description

A flaw was found in the Linux kernel's ksmbd component. An authenticated Server Message Block (SMB) client with only FILE_WRITE_ATTRIBUTES permission can bypass a security check in the FSCTL_SET_ZERO_DATA function. This allows the client to zero out file data, leading to data destruction and a denial of service.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-266 · Incorrect Privilege Assignment