CVE-2026-64398

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: add a permission check for FSCTL_SET_ZERO_DATA<br /> <br /> FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via<br /> ksmbd_vfs_zero_data() -&gt; vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after<br /> checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no<br /> per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES<br /> still yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of<br /> FILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it<br /> O_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only<br /> the missing fp-&gt;daccess gate would. Reproduced on mainline 7.1-rc7 with<br /> KASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle<br /> zeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to<br /> (6/6; a FILE_READ_DATA-only handle was correctly denied).<br /> <br /> This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL<br /> permission bypass by adding a permission check for FSCTL_SET_SPARSE").<br /> Because SET_ZERO_DATA writes data (not an attribute), require<br /> FILE_WRITE_DATA.