CVE-2026-64395

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an attacker-readable destination. Require FILE_READ_DATA on the source handle before either VFS operation, matching other ksmbd data-copy paths.

Package Linux Kernel
Published 2026-07-25
Last modified 2026-07-25
Patch available
Yes

Affected versions

Fixed in 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1 and their respective stable series.

Fixed in
✓ 6.1.178 6.1.x ✓ 6.6.145 6.6.x ✓ 6.12.96 6.12.x ✓ 6.18.39 6.18.x ✓ 7.1.4 7.1.x ✓ 7.2-rc1

References

6 total
Showing 5 of 6 references View all on NVD

Frequently asked questions

  • What is CVE-2026-64395?

    CVE-2026-64395 is a unscored severity Linux kernel vulnerability . CVE-2026-64395 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • Is there a patch available for CVE-2026-64395?

    Yes. CVE-2026-64395 has been patched. Fixed versions include 6.1.178, 6.6.145, 6.12.96 and others.

  • Is CVE-2026-64395 actively exploited?

    No. CVE-2026-64395 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST