CVE-2026-64398 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators of Linux-based systems, and security teams responsible for monitoring and patching Linux deployments, especially those using ksmbd and exposed to authenticated SMB clients.

Why it matters

CVE-2026-64398 is a high-severity vulnerability in the Linux kernel's ksmbd implementation that allows authenticated SMB clients to zero file data without proper permissions. This issue requires immediate attention from Linux kernel maintainers, system administrators, and security teams to assess exposure, apply patches, and restrict SMB client access to sensitive systems and data.

• Potential data loss or corruption due to unauthorized file modifications.
• Increased risk of data breaches or system compromise through exploitation by malicious SMB clients.
• Need for urgent assessment and patching of vulnerable Linux kernel deployments.
• Potential service disruptions due to file system modifications.

Technical summary

The ksmbd implementation in the Linux kernel fails to properly check permissions for the FSCTL_SET_ZERO_DATA ioctl, allowing an authenticated SMB client with a handle opened using FILE_WRITE_ATTRIBUTES permissions to zero file data they are not authorized to modify. This issue is addressed in various Linux kernel patches. The vulnerability was introduced due to a lack of proper permission checks in the ksmbd implementation of the FSCTL_SET_ZERO_DATA ioctl. An authenticated SMB client can exploit this by opening a handle with FILE_WRITE_ATTRIBUTES permissions, which are not sufficient for this operation, allowing them to zero file data they do not have permission to modify. The vulnerability impacts Linux kernel

Defensive priority

High-priority assessment and remediation recommended for Linux kernel deployments using ksmbd, especially those exposed to untrusted or authenticated SMB clients.

Recommended defensive actions

• Assess Linux kernel deployments for exposure to untrusted or authenticated SMB clients.
• Verify and apply patches from Linux kernel maintainers.
• Restrict SMB client access to sensitive data and systems.
• Monitor for suspicious file modifications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was introduced due to a lack of proper permission checks in the ksmbd implementation of the FSCTL_SET_ZERO_DATA ioctl. An authenticated SMB client can exploit this by opening a handle with FILE_WRITE_ATTRIBUTES permissions, which are not sufficient for this operation, allowing them to zero file data they do not have permission to modify.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.