CVE-2026-64398: Linux Kernel Privilege Escalation Flaw

CVE-2026-64398 Overview

CVE-2026-64398 is a permission-check flaw in the Linux kernel's ksmbd in-kernel SMB3 server. The FSCTL_SET_ZERO_DATA operation in smb2_ioctl() destroys file data through ksmbd_vfs_zero_data() and vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after only checking the share-level KSMBD_TREE_CONN_FLAG_WRITABLE flag. The code performs no per-handle access check. An authenticated SMB client holding a handle opened with only FILE_WRITE_ATTRIBUTES can zero file contents it has no FILE_WRITE_DATA right to modify.

Critical Impact
An authenticated remote SMB user can corrupt or destroy file contents on shares exported by ksmbd without holding write-data permissions, breaking data integrity and availability.

Affected Products

Linux kernel with ksmbd enabled (reproduced on mainline 7.1-rc7)
Distributions shipping vulnerable ksmbd builds prior to the referenced stable commits
SMB shares served by ksmbd where clients can authenticate and open file handles

Discovery Timeline

2026-07-25 - CVE-2026-64398 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64398

Vulnerability Analysis

The ksmbd SMB2 IOCTL handler dispatches FSCTL_SET_ZERO_DATA requests to ksmbd_vfs_zero_data(), which invokes vfs_fallocate() with FALLOC_FL_PUNCH_HOLE or FALLOC_FL_ZERO_RANGE. Both modes destroy the contents of the specified byte range. Before dispatching the call, ksmbd verifies only that the tree connection carries the share-wide KSMBD_TREE_CONN_FLAG_WRITABLE flag. It never consults the per-handle desired access recorded in fp->daccess.

This is the unfixed sibling of the earlier fix in commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE"). Because SET_ZERO_DATA writes data rather than an attribute, the correct gate is FILE_WRITE_DATA [CWE-862, Missing Authorization].

Root Cause

When a client opens a handle requesting only FILE_WRITE_ATTRIBUTES, ksmbd's smb2_create_open_flags() still opens the underlying file O_WRONLY. FILE_WRITE_ATTRIBUTES is included in FILE_WRITE_DESIRE_ACCESS_LE, so the resulting struct file receives FMODE_WRITE. The vfs_fallocate()FMODE_WRITE sanity check therefore passes, and no upper-layer daccess check blocks the request.

Attack Vector

An authenticated SMB client opens a file with FILE_WRITE_ATTRIBUTES only and issues an SMB2 IOCTL of type FSCTL_SET_ZERO_DATA covering the target byte range. KASAN reproduction on mainline 7.1-rc7 demonstrated that a FILE_WRITE_ATTRIBUTES-only handle successfully zeroed 4096 bytes of file data, while a FILE_READ_DATA-only handle was correctly denied. Exploitation requires only network reachability to the SMB service and valid credentials with basic access to the share.

No verified public exploit code is available. See the upstream stable-tree commits (25377f3, 3072d82, 3320ba0, 57f2042, ca53bb1, deffa92) for the patch adding the FILE_WRITE_DATA gate.

Detection Methods for CVE-2026-64398

Indicators of Compromise

Unexpected zero-filled byte ranges appearing in files hosted on ksmbd shares, particularly where file mtime updates do not correspond to legitimate writes.
SMB2 IOCTL traffic to ksmbd servers with CtlCode0x000980C8 (FSCTL_SET_ZERO_DATA) from user sessions that lack write-data business justification.
Audit-log entries showing file opens with FILE_WRITE_ATTRIBUTES immediately followed by IOCTL activity against the same handle.

Detection Strategies

Capture SMB2 protocol telemetry and alert on FSCTL_SET_ZERO_DATA requests correlated with handles whose original CREATE desired-access mask did not include FILE_WRITE_DATA (0x00000002).
Compare kernel version and ksmbd module build against the fixed stable commits listed above; flag hosts running unpatched builds.
Track file integrity on data hosted by ksmbd using periodic hashing so silent zero-range corruption becomes visible.

Monitoring Recommendations

Enable ksmbd audit logging and forward SMB session, tree-connect, and IOCTL records to a centralized log store for retention and correlation.
Monitor kernel logs for KASAN or ksmbd warnings that may accompany experimental exploitation attempts.
Baseline expected FSCTL_SET_ZERO_DATA usage per share; most workloads never issue this control code, making anomalies easy to surface.

How to Mitigate CVE-2026-64398

Immediate Actions Required

Upgrade the Linux kernel to a version that includes the ksmbdFILE_WRITE_DATA permission check for FSCTL_SET_ZERO_DATA from the referenced stable commits.
Restrict ksmbd share exports to trusted, authenticated users only, and remove guest or anonymous access where possible.
Inventory hosts running ksmbd and prioritize patching on Internet-adjacent or multi-tenant SMB servers.

Patch Information

The fix adds an explicit FILE_WRITE_DATA check against fp->daccess before invoking ksmbd_vfs_zero_data(). Backports are available in stable trees via commits 25377f3, 3072d82, 3320ba0, 57f2042, ca53bb1, and deffa92. Rebuild or install the vendor kernel package that includes these commits, then reboot to load the corrected module.

Workarounds

Where patching is not yet possible, disable ksmbd and serve SMB with a userspace alternative such as Samba until the fixed kernel is deployed.
Set affected shares to read-only by clearing writable flags at the share configuration level, which removes the code path that reaches FSCTL_SET_ZERO_DATA.
Restrict inbound TCP/445 access with host and network firewalls so only trusted management networks can reach ksmbd.

bash

# Temporarily unload ksmbd until the patched kernel is installed
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd

# Confirm the running kernel includes the fix (commit hash should be present)
strings /boot/vmlinuz-$(uname -r) 2>/dev/null | grep -i ksmbd | head

# Restrict SMB access at the host firewall (example: allow only management subnet)
sudo nft add rule inet filter input tcp dport 445 ip saddr != 10.0.0.0/24 drop