CVE-2026-52944

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE<br /> <br /> FSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file&amp;#39;s sparse<br /> attribute and saves it through xattr without any permission checks.<br /> <br /> This exposes two issues:<br /> <br /> 1) A client on a read-only share can change the sparse attribute<br /> on files it opened, even though the share is read-only.<br /> Other FSCTL write operations already check<br /> test_tree_conn_flag(work-&gt;tcon, KSMBD_TREE_CONN_FLAG_WRITABLE),<br /> but FSCTL_SET_SPARSE does not.<br /> <br /> 2) Even on writable shares, clients without FILE_WRITE_DATA or<br /> FILE_WRITE_ATTRIBUTES access should not modify the sparse<br /> attribute. Similar handle-level checks exist in other functions<br /> but are missing here.<br /> <br /> Add both share-level writable check and per-handle access check.<br /> Use goto out on error to avoid leaking file references.