---
id: CVE-2026-64398
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

  FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via
  ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

  FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via
  ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.15, < 6.1.178'
  - 'linux_kernel >= 6.2, < 6.6.145'
  - 'linux_kernel >= 6.7, < 6.12.96'
  - 'linux_kernel >= 6.13, < 6.18.39'
  - 'linux_kernel >= 6.19, < 7.1.4'
patched:
  - linux_kernel 7.1.4
published: '2026-07-25'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64398'
references:
  - url: 'https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00672
epssPercentile: 0.49904
ingestedAt: '2026-09-05T13:39:57.775Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via
ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after
checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no
per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES
still yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of
FILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it
O_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only
the missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with
KASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle
zeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to
(6/6; a FILE_READ_DATA-only handle was correctly denied).

This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL
permission bypass by adding a permission check for FSCTL_SET_SPARSE").
Because SET_ZERO_DATA writes data (not an attribute), require
FILE_WRITE_DATA.

## Affected

- `linux_kernel >= 5.15, < 6.1.178`
- `linux_kernel >= 6.2, < 6.6.145`
- `linux_kernel >= 6.7, < 6.12.96`
- `linux_kernel >= 6.13, < 6.18.39`
- `linux_kernel >= 6.19, < 7.1.4`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.1.4`