CVE-2026-64398

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc7

Description An authenticated SMB client can bypass permission checks in the ksmbd module. The smb2 ioctl() function fails to perform a per-handle access check when processing FSCTL SET ZERO DATA, relying only on the share-level KSMBD TREE CONN FLAG WRITABLE flag. This allows a user with a handle opened only with FILE WRITE ATTRIBUTES to destroy file data via ksmbd vfs zero data() and vfs fallocate(), even if they lack the FILE WRITE DATA right. This occurs because FILE WRITE ATTRIBUTES results in an FMODE WRITE file pointer, which bypasses the vfs fallocate check.

Recommendations Update the Linux kernel to version 7.1-rc7 or later.