7.5

CVE-2026-64395

ksmbd: require source read access for duplicate extents

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: require source read access for duplicate extents

FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to
vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB
access mask granted to the source handle. A handle opened with attribute
access can consequently be used to copy file contents into an
attacker-readable destination.

Require FILE_READ_DATA on the source handle before either VFS operation,
matching other ksmbd data-copy paths.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version eb817368f50c1cbe1bd07044124aad7db6330e3a
Version < 2d2ab6983620c2d60ce7db72133984ca3873b929
Status affected
Version eb817368f50c1cbe1bd07044124aad7db6330e3a
Version < 67bdad9cf01b25030e3bf00bbce6c309319d6663
Status affected
Version eb817368f50c1cbe1bd07044124aad7db6330e3a
Version < b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f
Status affected
Version eb817368f50c1cbe1bd07044124aad7db6330e3a
Version < db231af842868268839f9f9619c68cb27830d8be
Status affected
Version eb817368f50c1cbe1bd07044124aad7db6330e3a
Version < a10942af27832c2761d020863a46e79bebe0567d
Status affected
Version eb817368f50c1cbe1bd07044124aad7db6330e3a
Version < cedff600f1642aa982178503552f0d007bc829c8
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.15
Status affected
Version 0
Version < 5.15
Status unaffected
Version <= 6.1.*
Version 6.1.178
Status unaffected
Version <= 6.6.*
Version 6.6.145
Status unaffected
Version <= 6.12.*
Version 6.12.96
Status unaffected
Version <= 6.18.*
Version 6.18.39
Status unaffected
Version <= 7.1.*
Version 7.1.4
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.332
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/2d2ab6983620c2d60ce7db72133984ca3873b929
https://git.kernel.org/stable/c/67bdad9cf01b25030e3bf00bbce6c309319d6663
https://git.kernel.org/stable/c/b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f
https://git.kernel.org/stable/c/db231af842868268839f9f9619c68cb27830d8be
https://git.kernel.org/stable/c/a10942af27832c2761d020863a46e79bebe0567d
https://git.kernel.org/stable/c/cedff600f1642aa982178503552f0d007bc829c8