In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
FSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file's sparse attribute and saves it through xattr without any permission checks.
This exposes two issues:
1) A client on a read-only share can change the sparse attribute on files it opened, even though the share is read-only. Other FSCTL write operations already check test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE), but FSCTL_SET_SPARSE does not.
2) Even on writable shares, clients without FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES access should not modify the sparse attribute. Similar handle-level checks exist in other functions but are missing here.
Add both share-level writable check and per-handle access check. Use goto out on error to avoid leaking file references.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.12Upgrade linux | Sep 30, 2026 | Jun 24, 2026 |
| Ubuntu | — | Upgrade linux-image-generic-64kUpgrade linux-image-realtime-hwe-26.04Upgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-gcp-7.0Upgrade linux-image-genericUpgrade linux-image-azure-fde-7.0Upgrade linux-image-generic-64k-7.0Upgrade linux-image-azure-fdeUpgrade linux-image-7.0.0-28-genericUpgrade linux-image-ibm-7.0Upgrade linux-image-oem-24.04dUpgrade linux-image-oracle-7.0Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-7.0.0-28-generic-64kUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-gke-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-virtualUpgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-7.0.0-2016-nvidia-bosUpgrade linux-image-ibmUpgrade linux-image-nvidiaUpgrade linux-image-gcpUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-7.0.0-1009-awsUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-7.0.0-1008-oracle-64kUpgrade linux-image-7.0.0-1010-azureUpgrade linux-image-virtual-7.0Upgrade linux-image-aws-64k-7.0Upgrade linux-image-7.0.0-1003-gkeUpgrade linux-image-7.0.0-1015-raspi-realtimeUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-azureUpgrade linux-image-oem-26.04Upgrade linux-image-7.0.0-1009-oemUpgrade linux-image-7.0.0-1009-aws-64kUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-7.0.0-1010-ibmUpgrade linux-image-nvidia-7.0Upgrade linux-image-gke-hwe-26.04Upgrade linux-image-7.0.0-1003-gke-64kUpgrade linux-image-7.0.0-28-realtime-64kUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-gcp-64kUpgrade linux-image-7.0.0-1008-gcpUpgrade linux-image-gke-7.0Upgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-raspi-realtime-7.0Upgrade linux-image-generic-7.0Upgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-7.0.0-1008-gcp-64kUpgrade linux-image-7.0.0-1016-nvidiaUpgrade linux-image-oem-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-7.0.0-1016-nvidia-64kUpgrade linux-image-7.0.0-1015-raspiUpgrade linux-image-raspi-7.0Upgrade linux-image-oem-24.04cUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-26.04aUpgrade linux-image-aws-7.0Upgrade linux-image-aws-64kUpgrade linux-image-awsUpgrade linux-image-7.0.0-1008-oracleUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-realtime-64k-7.0Upgrade linux-image-oracleUpgrade linux-image-nvidia-bosUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-28-realtimeUpgrade linux-image-realtime-7.0Upgrade linux-image-gke-64k-7.0Upgrade linux-image-oem-7.0Upgrade linux-image-realtime-64kUpgrade linux-image-gkeUpgrade linux-image-raspiUpgrade linux-image-azure-7.0Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-7.0.0-2016-nvidia-bos-64kUpgrade linux-image-7.0.0-1014-azureUpgrade linux-image-realtimeUpgrade linux-image-oracle-64k | Jul 20, 2026 | Jun 24, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 30, 2026 | Jun 24, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub