CVE-2026-64399

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the Linux kernel, the smb2 ioctl() function fails to perform necessary permission checks when processing the FSCTL DUPLICATE EXTENTS TO FILE control code. Specifically, it uses vfs clone file range() to overwrite destination file data without verifying the KSMBD TREE CONN FLAG WRITABLE share-level flag or the fp->daccess per-handle check. This allows a client to overwrite data on a read-only share or use a handle opened only with FILE WRITE ATTRIBUTES to modify file content, as the system incorrectly permits the operation without requiring FILE WRITE DATA permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.