CVE-2026-64395 ksmbd: require source read access for duplicate extents
An attacker can read file contents via duplicate extents without proper read access checks in the Linux kernel ksmbd module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64395?
CVE-2026-64395 is a high-severity missing authorization vulnerability in Linux kernel, published on 25 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: require source read access for duplicate extents
FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an attacker-readable destination.
Require FILE_READ_DATA on the source handle before either VFS operation, matching other ksmbd data-copy paths.
Which versions are affected by CVE-2026-64395?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64395?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-64395 being exploited?
There is no known exploitation of CVE-2026-64395 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64395, DEBIAN-CVE-2026-64395, GHSA-33q2-xqvr-5v3j, ROOT-OS-DEBIAN-12-CVE-2026-64395, ROOT-OS-UBUNTU-2204-CVE-2026-64395, UBUNTU-CVE-2026-64395.