CVE-2026-64398: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

CVE-2026-64398: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via
ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after
checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no
per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES
still yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of
FILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it
O_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only
the missing fp->daccess gate would. Reproduced on mainline 7.1-rc7 with
KASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle
zeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to
(6/6; a FILE_READ_DATA-only handle was correctly denied).

This is the unfixed sibling of commit cc57232cae23 ("ksmbd: fix FSCTL
permission bypass by adding a permission check for FSCTL_SET_SPARSE").
Because SET_ZERO_DATA writes data (not an attribute), require
FILE_WRITE_DATA.

The Linux kernel CVE team has assigned CVE-2026-64398 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.1.178 with commit 25377f369688dd0bd814dc8965ed26d44238ecaa
	Fixed in 6.6.145 with commit 3072d82461f498c85daea8766e9d8bfbada31605
	Fixed in 6.12.96 with commit ca53bb17f4e8232cfaece3953d3cef62c559b039
	Fixed in 6.18.39 with commit 57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7
	Fixed in 7.1.4 with commit deffa929086d7902e30918adf3dd27ccfe9c08b1
	Fixed in 7.2-rc1 with commit 3320ba068198adc144c89d6661b805acce01735b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64398
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/server/smb2pdu.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa
	https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605
	https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039
	https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7
	https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1
	https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b