CVE-2026-52944 ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

Medium 5.5 Published 24 Jun 2026 Updated 14 Sep 2026

Attackers can bypass read-only share restrictions and modify file sparse attributes without proper write permissions in the Linux kernel ksmbd module.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-52944?

CVE-2026-52944 is a medium-severity missing authorization vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

FSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file's sparse attribute and saves it through xattr without any permission checks.

This exposes two issues:

1) A client on a read-only share can change the sparse attribute on files it opened, even though the share is read-only. Other FSCTL write operations already check test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE), but FSCTL_SET_SPARSE does not.

2) Even on writable shares, clients without FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES access should not modify the sparse attribute. Similar handle-level checks exist in other functions but are missing here.

Add both share-level writable check and per-handle access check. Use goto out on error to avoid leaking file references.

Which versions are affected by CVE-2026-52944?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-52944?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-52944 being exploited?

There is no known exploitation of CVE-2026-52944 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2026-52944, DEBIAN-CVE-2026-52944, GHSA-v762-vr2v-9263, ROOT-OS-DEBIAN-12-CVE-2026-52944, ROOT-OS-DEBIAN-13-CVE-2026-52944, ROOT-OS-UBUNTU-2204-CVE-2026-52944 and 2 more.