CVE-2026-64399

kernel: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

Loading…

Severity

Important

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · July 25, 2026

Updated · October 20, 2026

Description

A flaw was found in ksmbd. This vulnerability allows a remote attacker to overwrite data on a shared file system due to insufficient permission checks in the FSCTL_DUPLICATE_EXTENTS_TO_FILE function. Even if a share is configured as read-only or a client has limited write attributes, an attacker can still modify the destination file's data, leading to unauthorized data alteration.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-250 · Execution with Unnecessary Privileges