CVE-2026-64399
published 2026-07-25CVE-2026-64399: In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.72%
52.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the
destination file's data via vfs_clone_file_range() with neither the
share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle
fp->daccess check that the other write-bearing arms carry. A client can
overwrite destination data on a read-only share, or from a handle opened
with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).
FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via
the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;
require FILE_WRITE_DATA since this writes data.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= eb817368f50c1cbe1bd07044124aad7db6330e3a < bf460ad5958d506492de4524a656439da3f99c51 | bf460ad5958d506492de4524a656439da3f99c51 |
| linux | linux | >= eb817368f50c1cbe1bd07044124aad7db6330e3a < 620d133d469295ee7c017ca6aafac335f65c4a5a | 620d133d469295ee7c017ca6aafac335f65c4a5a |
| linux | linux | >= eb817368f50c1cbe1bd07044124aad7db6330e3a < 9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6 | 9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6 |
| linux | linux | >= eb817368f50c1cbe1bd07044124aad7db6330e3a < baae7b39673ec21073a25e3d14f8feaada01d5df | baae7b39673ec21073a25e3d14f8feaada01d5df |
| linux | linux | >= eb817368f50c1cbe1bd07044124aad7db6330e3a < c917e4522d251071dde9871b9142d8ea1186ebfe | c917e4522d251071dde9871b9142d8ea1186ebfe |
| linux | linux | >= eb817368f50c1cbe1bd07044124aad7db6330e3a < 388e4139db27a9e3612c9d356b826f5b1ff6a9e3 | 388e4139db27a9e3612c9d356b826f5b1ff6a9e3 |
| linux | linux_kernel | >= 5.15 < 6.1.178 | 6.1.178 |
| linux | linux_kernel | >= 6.13 < 6.18.39 | 6.18.39 |
| linux | linux_kernel | >= 6.19 < 7.1.4 | 7.1.4 |
| linux | linux_kernel | >= 6.2 < 6.6.145 | 6.6.145 |
| linux | linux_kernel | >= 6.7 < 6.12.96 | 6.12.96 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-7.0 | — | — |
| ubuntu | linux-azure | — | — |
| ubuntu | linux-azure-7.0 | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-gcp-7.0 | — | — |
| ubuntu | linux-gke | — | — |
| ubuntu | linux-hwe-7.0 | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-nvidia-7.0 | — | — |
| ubuntu | linux-nvidia-bos | — | — |
| ubuntu | linux-nvidia-tegra | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
vendor_ubuntu9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-09-29·CVSS 9.1
CVE-2026-64191 [CRITICAL] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were d
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-52938 [CRITICAL] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were di
Ubuntu
Linux kernel (NVIDIA BaseOS) vulnerabilities
vendor_ubuntu·2026-09-22
CVE-2026-64504 Linux kernel (NVIDIA BaseOS) vulnerabilities
Title: Linux kernel (NVIDIA BaseOS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 9.1
CVE-2026-53358 [CRITICAL] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- PowerPC architecture;
- RIS
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-09-15
CVE-2026-63869 Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buf
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-52938 [CRITICAL] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were disc
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Red Hat
kernel: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
vendor_redhat·2026-07-25·CVSS 9.8
CVE-2026-64399 [CRITICAL] CWE-250 kernel: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
kernel: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
A flaw was found in ksmbd. This vulnerability allows a remote attacker to overwrite data on a shared file system due to insufficient permission checks in the FSCTL_DUPLICATE_EXTENTS_TO_FILE function. Even if a share is configured as read-only or a client has limited write attributes, an attacker can still modify the destination file's data, leading to unauthorized data alteration.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Ente
VulDB
Linux Kernel up to 7.1.3 ksmbd smb2_ioctl daccess permission
vuldb·2026-09-05·CVSS 9.8
CVE-2026-64399 [CRITICAL] Linux Kernel up to 7.1.3 ksmbd smb2_ioctl daccess permission
A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. This vulnerability affects the function smb2_ioctl of the component ksmbd. Such manipulation of the argument daccess leads to permission issues.
This vulnerability is referenced as CVE-2026-64399. It is possible to launch the attack remotely. No exploit is available.
You should upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrite
ghsa_unreviewed·2026-07-25
CVE-2026-64399 In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrite
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the
destination file's data via vfs_clone_file_range() with neither the
share-level KSMBD_TREE_CONN_FLAG_WRITABLE check nor a per-handle
fp->daccess check that the other write-bearing arms carry. A client can
overwrite destination data on a read-only share, or from a handle opened
with only FILE_WRITE_ATTRIBUTES (which still yields an FMODE_WRITE filp).
FILE_WRITE_ATTRIBUTES-only destination handle overwrote the file's data via
the clone. Add both checks, matching the FSCTL_SET_SPARSE permission fix;
require FILE_WRITE_DATA since this writes data.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5ahttps://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5dfhttps://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe
2026-07-25
Published