Linux Kernel CVE-2026-64399

ksmbd is the Linux kernel's native SMB3 file-server module (fs/smb/server). SMB clients invoke server-side operations through the SMB2 IOCTL command; the FSCTL_DUPLICATE_EXTENTS_TO_FILE code performs a reflink/copy-on-write clone of source extents into a destination file using the VFS vfs_clone_file_range() helper, which writes data into the destination. The other write-bearing FSCTL arms guard this with two gates: KSMBD_TREE_CONN_FLAG_WRITABLE (the share was mounted/exported writable) and a per-handle fp->daccess check confirming the open granted write-data rights. The duplicate-extents arm had neither, so a handle opened with only FILE_WRITE_ATTRIBUTES - which still produces an FMODE_WRITE file pointer at the VFS layer - was accepted as sufficient to clone-overwrite data. This is a classic missing-authorization / incorrect-permission-assignment root cause (CWE-284/CWE-863); the input CWE is listed as N/A. The CPE data identifies the affected component only generically as cpe:2.3:a:linux:linux, i.e. the mainline kernel tree containing the ksmbd server.