CVE-2026-64395: Linux Kernel ksmbd Info Disclosure Flaw

CVE-2026-64395 Overview

CVE-2026-64395 is a Linux kernel vulnerability in the ksmbd in-kernel SMB server. The flaw resides in the handler for FSCTL_DUPLICATE_EXTENTS_TO_FILE, which passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without validating the SMB access mask granted to the source handle. A remote authenticated client holding a handle opened only with attribute access can copy file contents into an attacker-readable destination, exposing data the caller was never authorized to read. The issue has been resolved upstream by requiring FILE_READ_DATA on the source handle before either VFS operation, aligning with existing ksmbd data-copy paths.

Critical Impact
An authenticated SMB client can bypass access mask enforcement to read confidential file contents through the duplicate-extents FSCTL, resulting in unauthorized information disclosure over the network.

Affected Products

Linux kernel ksmbd SMB server module (upstream mainline)
Linux stable kernel branches receiving ksmbd backports
Distributions shipping ksmbd prior to the referenced fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64395 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64395

Vulnerability Analysis

The ksmbd module implements SMB3 server functionality inside the Linux kernel. When a client issues FSCTL_DUPLICATE_EXTENTS_TO_FILE, ksmbd forwards the source and destination file objects to vfs_clone_file_range() (for reflink-capable filesystems) or vfs_copy_file_range() (as a fallback). The vulnerable code path does not consult the SMB access mask associated with the source handle before performing the copy.

SMB access rights are enforced at handle-open time. A caller can legitimately obtain a handle with only attribute rights, such as FILE_READ_ATTRIBUTES, without being granted FILE_READ_DATA. Because the FSCTL implementation skipped this check, a client with an attribute-only source handle could still direct the server to duplicate file contents into a destination file the client controls and can read. This is an authorization bypass leading to information disclosure over the network.

Root Cause

The root cause is missing access control enforcement between the SMB layer and the VFS layer. Other ksmbd data-copy paths validate that the source handle carries FILE_READ_DATA before invoking VFS copy primitives, but the FSCTL_DUPLICATE_EXTENTS_TO_FILE handler omitted this check. The fix introduces the missing FILE_READ_DATA requirement on the source handle, harmonizing this path with the rest of the ksmbd data-copy logic.

Attack Vector

Exploitation requires network reachability to a Linux system exporting shares through ksmbd and an SMB session that can open a source file handle with any access, including attribute-only access. The attacker then issues an FSCTL_DUPLICATE_EXTENTS_TO_FILE request naming a destination handle they can read. The server performs the copy without verifying source read permission, allowing the attacker to retrieve the file contents. User interaction is not required. See the upstream fixes for the exact code changes: Kernel Commit 2d2ab69, Kernel Commit 67bdad9, and Kernel Commit db231af.

Detection Methods for CVE-2026-64395

Indicators of Compromise

SMB2 IOCTL requests carrying the FSCTL_DUPLICATE_EXTENTS_TO_FILE control code (0x00098344) directed at a ksmbd server.
Unexpected file growth or content changes on shares exported by ksmbd, where the destination file's size matches a sensitive source file.
SMB sessions opening source handles with minimal access masks followed by duplicate-extents FSCTL calls in the same session.

Detection Strategies

Inspect SMB traffic to ksmbd hosts for FSCTL_DUPLICATE_EXTENTS_TO_FILE IOCTLs and correlate the source handle's original open access mask with the requested operation.
Enable kernel auditing on files exported by ksmbd and alert on clone or copy events initiated by handles opened without FILE_READ_DATA.
Track kernel package versions across Linux fleets and flag hosts running vulnerable ksmbd builds that predate the referenced stable commits.

Monitoring Recommendations

Forward SMB server logs, kernel audit records, and file integrity events into a centralized analytics pipeline for cross-source correlation.
Baseline normal use of duplicate-extents and reflink operations per user and per share, alerting on unusual sources or destinations.
Monitor for anomalous read patterns from SMB accounts, particularly accounts that historically only enumerate metadata.

How to Mitigate CVE-2026-64395

Immediate Actions Required

Update Linux kernels to a version that includes the upstream ksmbd fix requiring FILE_READ_DATA on the source handle for FSCTL_DUPLICATE_EXTENTS_TO_FILE.
Restrict network exposure of ksmbd services to trusted management segments and enforce SMB signing and encryption.
Audit share permissions and remove unnecessary write access on destinations that could serve as attacker-controlled sinks.

Patch Information

The vulnerability is resolved by the ksmbd change that requires FILE_READ_DATA on the source handle before invoking vfs_clone_file_range() or vfs_copy_file_range(). Apply the fix from the corresponding stable branch commit: Kernel Commit a10942a, Kernel Commit b0d4d5c, or Kernel Commit cedff60. Rebuild and reboot into the patched kernel to fully activate the mitigation.

Workarounds

Disable ksmbd and use an alternate SMB server such as Samba until the kernel can be patched.
Block inbound SMB (TCP/445) at the network perimeter and internal segmentation firewalls for hosts that do not require SMB access.
Remove or restrict write-capable share exports so attackers cannot stage attacker-readable destination files on the server.

bash

# Configuration example: disable ksmbd until the kernel is patched
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd

# Prevent the module from loading at boot
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf