{"id":"CVE-2026-64398","state":"PUBLISHED","title":"ksmbd: add a permission check for FSCTL_SET_ZERO_DATA","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a permission check for FSCTL_SET_ZERO_DATA\n\nFSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via\nksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after\nchecking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no\nper-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES\nstill yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of\nFILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it\nO_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only\nthe missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with\nKASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle\nzeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to\n(6/6; a FILE_READ_DATA-only handle was correctly denied).\n\nThis is the unfixed sibling of commit cc57232cae23 (\"ksmbd: fix FSCTL\npermission bypass by adding a permission check for FSCTL_SET_SPARSE\").\nBecause SET_ZERO_DATA writes data (not an attribute), require\nFILE_WRITE_DATA.","publishedAt":"2026-07-25T08:50:42.221Z","updatedAt":"2026-08-17T04:54:54.292Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"25377f369688dd0bd814dc8965ed26d44238ecaa","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"3072d82461f498c85daea8766e9d8bfbada31605","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"ca53bb17f4e8232cfaece3953d3cef62c559b039","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"deffa929086d7902e30918adf3dd27ccfe9c08b1","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"3320ba068198adc144c89d6661b805acce01735b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.96","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.39","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]}],"references":["https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa","https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605","https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039","https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7","https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1","https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64398.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64398","state":"PUBLISHED","datePublished":"2026-07-25T08:50:42.221Z","dateUpdated":"2026-08-17T04:54:54.292Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.785Z"},"containers":{"cna":{"title":"ksmbd: add a permission check for FSCTL_SET_ZERO_DATA","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a permission check for FSCTL_SET_ZERO_DATA\n\nFSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via\nksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after\nchecking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no\nper-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES\nstill yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of\nFILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it\nO_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only\nthe missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with\nKASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle\nzeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to\n(6/6; a FILE_READ_DATA-only handle was correctly denied).\n\nThis is the unfixed sibling of commit cc57232cae23 (\"ksmbd: fix FSCTL\npermission bypass by adding a permission check for FSCTL_SET_SPARSE\").\nBecause SET_ZERO_DATA writes data (not an attribute), require\nFILE_WRITE_DATA."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"25377f369688dd0bd814dc8965ed26d44238ecaa","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"3072d82461f498c85daea8766e9d8bfbada31605","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"ca53bb17f4e8232cfaece3953d3cef62c559b039","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"deffa929086d7902e30918adf3dd27ccfe9c08b1","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","status":"affected","lessThan":"3320ba068198adc144c89d6661b805acce01735b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.96","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.39","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa"},{"url":"https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605"},{"url":"https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039"},{"url":"https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7"},{"url":"https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1"},{"url":"https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable ksmbd handler processes SMB2 IOCTL requests received remotely over SMB on TCP port 445.\nAC:L - An attacker can deterministically open a metadata-only handle and submit one or more SET_ZERO_DATA requests with attacker-controlled ranges; no race or uncontrollable condition is required.\nPR:L - The path requires a valid SMB session, access to a writable share, and permission to open the target with FILE_WRITE_ATTRIBUTES, but it does not require administrative privileges.\nUI:N - Exploitation occurs entirely through attacker-generated SMB requests and requires no victim action.\nS:U - The flaw corrupts files managed by the same ksmbd host and does not cross a VM, sandbox, or other security-authority boundary.\nC:N - The operation only zeros or deallocates file ranges; it provides no data-read primitive, information disclosure, or kernel-memory corruption.\nI:H - The attacker can persistently zero arbitrary selected ranges, including an entire file, despite lacking FILE_WRITE_DATA permission; SET_ZERO_DATA is explicitly a file-content modification operation ([Microsoft MS-FSCC](https://learn.microsoft.com/en-us/openspecs/windows_protoco ls/ms-fscc/6be5164f-3eb6-4149-b997-c37df1444779)).\nA:H - Repeatedly erasing critical databases, configurations, firmware images, or application data on an SMB share can cause complete and persistent service or resource unavailability until restoration."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:54:54.292Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.96"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}