In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE
The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl() overwrites the destination file's data via vfsclonefilerange() with neither the share-level KSMBDTREECONNFLAGWRITABLE check nor a per-handle fp->daccess check that the other write-bearing arms carry. A client can overwrite destination data on a read-only share, or from a handle opened with only FILEWRITEATTRIBUTES (which still yields an FMODEWRITE filp). FILEWRITEATTRIBUTES-only destination handle overwrote the file's data via the clone. Add both checks, matching the FSCTLSETSPARSE permission fix; require FILEWRITE_DATA since this writes data.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64399.json",
"cna_assigner": "Linux"
}