CVE-2026-64395 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches or mitigations as needed. Affected operators and security teams must verify that FILE_READ_DATA access mask is required for source handles and implement additional security controls to prevent unauthorized access to sensitive data.

Why it matters

The vulnerability allows an attacker to gain unauthorized access to sensitive data by exploiting the ksmbd module in the Linux kernel. Defenders should assess exposure, apply patches or mitigations, and monitor for suspicious activity.

• Verify that FILE_READ_DATA access mask is required for source handles
• Ensure that patches are applied to the Linux kernel
• Monitor for suspicious activity and implement additional security controls as needed

Technical summary

The Linux kernel's ksmbd module is vulnerable to an unauthorized data access issue due to a lack of proper access control checks when handling the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation. Specifically, the ksmbd module does not require the FILE_READ_DATA access mask on the source handle before performing the copy operation, allowing an attacker to copy file contents into an attacker-readable destination. This requires defenders to assess exposure, apply patches or mitigations, and monitor for suspicious activity.

Defensive priority

High

Recommended defensive actions

• Review and apply the available patches to the Linux kernel
• Restrict access to sensitive data and ensure that FILE_READ_DATA access mask is required for source handles
• Monitor for suspicious activity and implement additional security controls as needed
• Verify that FILE_READ_DATA access mask is required for source handles
• Ensure that patches are applied to the Linux kernel
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and the NVD vulnerability detail page. The Linux kernel maintainers have provided patches to address this vulnerability. Affected systems require verification of FILE_READ_DATA access mask for source handles and application of patches or mitigations. Defenders should verify exposure, apply patches or mitigations, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.