CVE-2026-64399

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the

destination file's data via vfs_clone_file_range() with neither the

share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle

fp->daccess check that the other write-bearing arms carry. A client can

overwrite destination data on a read-only share, or from a handle opened

with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).

FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via

the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;

require FILE_WRITE_DATA since this writes data.