CVE-2026-64399: Linux Kernel ksmbd Privilege Escalation

CVE-2026-64399 Overview

CVE-2026-64399 is a permission-check flaw in the Linux kernel's ksmbd in-kernel SMB3 server. The FSCTL_DUPLICATE_EXTENTS_TO_FILE branch of smb2_ioctl() calls vfs_clone_file_range() to overwrite destination file data without enforcing the share-level KSMBD_TREE_CONN_FLAG_WRITABLE flag or the per-handle fp->daccess check applied by other write-bearing branches. A remote SMB client can overwrite data on a read-only share, or through a handle opened with only FILE_WRITE_ATTRIBUTES, which still yields an FMODE_WRITE file pointer. The upstream fix requires FILE_WRITE_DATA before permitting the clone, matching the FSCTL_SET_SPARSE permission fix.

Critical Impact
Unauthenticated or minimally authorized SMB clients can overwrite destination file data on shares or handles that should be read-only, breaking file integrity guarantees on ksmbd-exported filesystems.

Affected Products

Linux kernel ksmbd in-kernel SMB server module
Linux distributions shipping kernels that expose ksmbd shares
Systems exporting SMB shares via ksmbd with read-only or restricted-access permissions

Discovery Timeline

2026-07-25 - CVE-2026-64399 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64399

Vulnerability Analysis

The ksmbd module implements an in-kernel SMB3 file server. When handling SMB2 IOCTL requests, smb2_ioctl() dispatches on the FSCTL code. Most write-bearing FSCTLs consult two safeguards: the tree-connection flag KSMBD_TREE_CONN_FLAG_WRITABLE, which reflects whether the share was mounted as writable, and the per-handle fp->daccess field, which records the desired-access mask granted at open time.

The FSCTL_DUPLICATE_EXTENTS_TO_FILE branch omits both checks. It proceeds directly to vfs_clone_file_range(), which reflinks source extents onto the destination file and replaces its contents. Because the code path never verifies writable access, a client on a read-only share can mutate destination file data. Similarly, a handle opened with only FILE_WRITE_ATTRIBUTES — sufficient to modify metadata such as timestamps — passes through because that access flag produces an FMODE_WRITE filp, which lower VFS layers accept.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in a privileged IOCTL handler. The FSCTL_DUPLICATE_EXTENTS_TO_FILE handler in smb2_ioctl() does not gate the destination write behind KSMBD_TREE_CONN_FLAG_WRITABLE or a fp->daccess & FILE_WRITE_DATA check, unlike sibling FSCTL branches such as FSCTL_SET_SPARSE that received the same class of fix.

Attack Vector

The attack vector is network-based over SMB. An authenticated SMB client with any handle to the destination file — including one opened with only FILE_WRITE_ATTRIBUTES — issues an SMB2 IOCTL with control code FSCTL_DUPLICATE_EXTENTS_TO_FILE. The ksmbd handler clones extents from a source file to the destination, overwriting destination content on disk. The same primitive works on shares configured as read-only, breaking share-level access controls.

No public exploit or proof-of-concept is listed. Refer to the upstream kernel commits for the exact patched code paths, including commit 388e4139db27 and commit c917e4522d25.

Detection Methods for CVE-2026-64399

Indicators of Compromise

Unexpected modification timestamps or content changes on files residing on ksmbd-exported read-only shares
SMB2 IOCTL requests carrying FSCTL code 0x00098344 (FSCTL_DUPLICATE_EXTENTS_TO_FILE) issued against handles opened without FILE_WRITE_DATA
Kernel audit records showing vfs_clone_file_range() invocations originating from ksmbd against files on read-only exports

Detection Strategies

Inspect SMB2 IOCTL traffic on the wire and flag FSCTL_DUPLICATE_EXTENTS_TO_FILE requests targeting shares configured as read-only in ksmbd.conf
Correlate file integrity monitoring alerts on ksmbd-hosted directories with SMB session logs to identify unauthorized reflink-based overwrites
Enable kernel auditing on ksmbd worker threads and record clone operations against file handles whose desired-access mask lacks FILE_WRITE_DATA

Monitoring Recommendations

Forward ksmbd kernel logs and SMB session telemetry to a centralized data lake for retrospective hunting against clone-based overwrite patterns
Baseline the set of clients that legitimately issue FSCTL_DUPLICATE_EXTENTS_TO_FILE and alert on new sources, especially those targeting read-only shares
Watch for kernel version disclosures over SMB negotiation that indicate unpatched ksmbd deployments still exposed to the network

How to Mitigate CVE-2026-64399

Immediate Actions Required

Upgrade to a Linux kernel release that includes the ksmbd permission-check fixes referenced in the six stable commits linked in the advisory
If patching is not immediately possible, unload the ksmbd module (modprobe -r ksmbd) on hosts that do not require in-kernel SMB serving
Restrict SMB (TCP/445) exposure at the network perimeter and permit connections only from trusted management subnets
Audit ksmbd.conf share definitions and confirm the actual on-disk permissions do not rely solely on the read only share option for integrity

Patch Information

The fix adds both the KSMBD_TREE_CONN_FLAG_WRITABLE share check and a fp->daccess & FILE_WRITE_DATA handle check to the FSCTL_DUPLICATE_EXTENTS_TO_FILE branch of smb2_ioctl(), mirroring the FSCTL_SET_SPARSE permission fix. Backports are available across stable trees in commit 620d133d4692, commit 9b9cf7e65cbe, commit baae7b39673e, and commit bf460ad5958d.

Workarounds

Replace ksmbd with a userspace SMB server such as Samba on hosts that cannot be patched promptly
Block SMB2 IOCTL traffic carrying FSCTL_DUPLICATE_EXTENTS_TO_FILE at inline inspection points that support SMB deep parsing
Set the underlying filesystem or export mount as ro at the VFS layer so that ksmbd cannot reflink writes regardless of share-level flags

bash

# Verify ksmbd module status and remove if unused
lsmod | grep ksmbd
sudo modprobe -r ksmbd

# Confirm patched kernel is running after upgrade
uname -r

# Restrict SMB access at the host firewall
sudo nft add rule inet filter input tcp dport 445 ip saddr != 10.0.0.0/24 drop