CVE-2026-64399

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE

The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2_ioctl() overwrites the

destination file's data via vfsclonefile_range() with neither the

share-level KSMBDTREECONNFLAGWRITABLE check nor a per-handle

fp->daccess check that the other write-bearing arms carry. A client can

overwrite destination data on a read-only share, or from a handle opened

with only FILEWRITEATTRIBUTES (which still yields an FMODE_WRITE filp).

FILEWRITEATTRIBUTES-only destination handle overwrote the file's data via

the clone. Add both checks, matching the FSCTLSETSPARSE permission fix;

require FILEWRITEDATA since this writes data.